[3.0] Look for a gallery avatar where the gallery is

[albertlast]

Note

This change was produced by an LLM. The fix, the tests, the commit message and
this description were all written by Claude (Anthropic), driven by @albertlast. It
has not yet had human code review.

Description

Config::$modSettings['avatar_directory'] is where the avatar gallery lives. It is
a setting the admin owns:

• Actions/Admin/Attachments.php offers the field, defaults it to
  Config::$boarddir . '/avatars' when it is submitted empty, and shows
  avatar_directory_wrong when the directory it names is not a directory.
• Profile::getAvatars() lists the gallery out of it.
• Profile refuses to save a chosen avatar whose realpath() does not start with
  it.

So a stored gallery avatar is a path into that directory, and the forum has already
said so twice by the time Avatar sees it.

Avatar looked under Config::$boarddir . '/avatars', hard-coded, in the three
places that find the file — while building the address from
Config::$modSettings['avatar_url'], which is the URL of the configured
directory. The path and the address only name the same place while the admin leaves
the setting alone.

When they do not, every member's chosen avatar is looked for somewhere it has never
been: not found at the gallery step, not found in custom_avatar, and answered with
default.png. A forum that moved its avatars directory shows the default image for
everybody, with nothing in the error log to say why.

The fix reads the setting in one place, getGalleryDir(), and keeps the admin
panel's own default as the fallback for a forum that never wrote the setting.

These are regression tests

tests/Unit/AvatarGalleryDirectoryTest.php points avatar_directory at
Themes/default/images, which stands in for a moved gallery: full of images, not
the directory SMF ships the gallery in, and nothing has to be written to disk to
use it.

Against the unfixed constructor, two of the three fail, and the failure is the
symptom rather than an abstraction of it:

-'https://example.com/gallery/cake.png'
+'https://example.com/gallery/default.png'

The third passes either side, which is the point of it: a forum whose admin never
touched the setting keeps the gallery SMF ships.

Notes for review

• The comment on case 2 said "prepackaged avatar directory". The gallery is
  prepackaged only until someone moves it, so it now says what the case looks in.
• case 4, which works a filename back out of a URL path, is one of the three. It
  is checking that a resolved path sits inside a directory avatars are allowed to
  be in, and after this change the set of those directories is the configured one
  plus custom_avatar_dir — which is the same set Profile validates against.
  Config::$boarddir . '/avatars' is deliberately not kept alongside it: on a forum
  that moved the gallery, it is no longer an avatar directory.
• The test file is its own rather than joining an AvatarTest.php, because [3.0][Testing] Cover four more merged fixes in the unit suite #9586
  and [3.0] End the search for an avatar at the last resort #9587 each add an Avatar test file of their own and I would rather they merge
  in any order than have three PRs conflict on one file.
• Found while sweeping merged fixes for [3.0][Testing] Cover four more merged fixes in the unit suite #9586. [3.0] End the search for an avatar at the last resort #9587 came out of the same sweep and
  is the more urgent of the two.

Issues References (Fixes|Related|Closes)

Related to #9586, #9587.