Skip validation when decoding API responses

[chiiya]

Problem

Fixes chiiya/laravel-passes#40.

Updating (or fetching) a pass decodes the API response back into component objects via BaseRepository. Component::__construct() runs Symfony validation on every construction — including during decode() — so a response that legitimately omits fields only required when creating a pass throws spurious validation errors:

Validation errors:
  - Chiiya\Passes\Google\Passes\LoyaltyClass->programName: The field is required.
  - Chiiya\Passes\Google\Passes\LoyaltyClass->issuerName: The field is required.

The reporter correctly traced it to BaseRepository::update(), which builds a LoyaltyObject from the response whose classReference is partial.

Root cause

Requiredness/validity is a send-time concern, but it was being enforced at parse-time. We don't control what Google returns, so decoding must be lenient.

Fix

Skip validation while decoding. Component::decode() toggles a guard that makes __construct() bypass validation, and restores the previous value in a finally (so nested decoding — e.g. classReference inside an object — is handled correctly). Validation still runs for objects you construct directly to send, so invalid outgoing data is still caught.

This resolves the whole class of "validation failed while decoding a response" bugs, not just the loyalty case.

Scope note

A response can also fail to decode if it omits a field whose property is non-nullable (e.g. LoyaltyClass::$programLogo), which would throw a TypeError rather than a validation error. In practice a real classReference includes the class's genuinely-required fields, so this isn't hit by #40. Making every decodable required field nullable would touch ~60 fields across ~38 files and is intentionally left out of this PR.

Tests

Added tests/Common/ComponentTest.php:

• decoding a response with an unexpected constraint value does not throw
• constructing the same object directly still throws ValidationException
• decoding a LoyaltyObject with a nested partial classReference (the Bump actions/checkout from 4 to 5 #40 path) succeeds

Full suite passes (57 tests); just lint clean.