Throw on iconv() failure and default fputcsv escape to empty string

[dereuromark]

Summary

Two small correctness fixes around the row writer. Two commits, one per fix — revert independently if needed.

1. iconv() failure throws instead of silently dropping a row

When dataEncoding !== csvEncoding and the iconv path is selected, _generateRow() previously assigned iconv(...) straight into $csv. iconv() can return false (unsupported target encoding, malformed source bytes); that false was concatenated into the accumulator where (string)false === '', producing a row of nothing with no exception, no log, no signal to the user. Their export looked successful but quietly contained empty rows.

Now we check the return value and throw a CakeException naming the source and target encodings so the failure is impossible to miss.

Regression test: testIconvFailureThrows configures a bogus target encoding to force iconv() to return false and asserts the exception fires (wrapped by SerializedView's SerializationFailureException).

2. Default escape is now '' (RFC 4180, PHP 8.4 compliant)

PHP 8.4 deprecates passing a non-empty $escape to fputcsv(). The shipped default was the legacy '\\' value introduced by #145 specifically to make the parameter explicit — but on PHP 8.4 this triggers E_DEPRECATED for every rendered CSV. PHP plans to make it a hard error in a future release.

Switching the default to '':

• Silences the deprecation today.
• Produces RFC 4180-compliant output: quotes inside a field are escaped by doubling them ("") instead of by a preceding backslash.
• Users who want the legacy backslash behavior can still set escape => '\\' explicitly (and will see the matching PHP deprecation; documented in the docblock).

Behavior change: when a field contains a literal backslash immediately before the enclosure character, the output now uses doubled-quote escaping instead of backslash-quote. In practice every mainstream CSV consumer (Excel, LibreOffice, Google Sheets, PHP's own fgetcsv) handles both correctly. Worth a CHANGELOG note at the next release.

Regression test: testDefaultEscapeIsRfc4180 renders a field with embedded double-quotes and asserts (a) the output matches the doubled-quote form and (b) PHP did not emit E_DEPRECATED during render.

=> new minor release

CI

The cs-stan job is expected to fail on this PR for the same pre-existing reason #147 is fixing (squizlabs/php_codesniffer v4 vs slevomat 8.29 incompatibility). Nothing in this PR affects code style; once #147 lands, rebasing makes CI green.

Relationship to other open PRs

Independent of:

• Fix CsvView state reset and 5.x cs-stan setup #147 (state-leak + extract-path consolidation + cs-stan infra fix)
• Add excel shorthand for Excel-friendly UTF-8 exports #148 (excel shorthand for UTF-8 Excel exports)

Any of the three can land first; all three are clean low-risk additions on top of pristine 5.x.

[dereuromark]

Addressed in 54ab09b. Added a transcodingMode config option with three values exposed as class constants:

• TRANSCODING_MODE_STRICT (default): throws on iconv failure (the original behavior of this PR).
• TRANSCODING_MODE_IGNORE: passes //IGNORE to iconv (or mb_substitute_character('none') for mbstring) so unconvertible bytes are dropped and the rest of the row continues.
• TRANSCODING_MODE_TRANSLITERATE: passes //TRANSLIT//IGNORE so accented Latin transliterates to ASCII where possible.

Tests for both ignore and transliterate paths added. Moved the conversion into a new _transcode() hook for cleanliness and so apps can override per-view.