docs: open the upgrade guide with require, not update

[turegjorup]

A second coherence pass over UPGRADE-6.0.md, walked against two consumers again now that #71 restructured it. The structure held up; the very first command did not.

The finding

The guide opened with:

composer update itk-dev/openid-connect-bundle

That cannot install 6.0. Every consumer pins a major, and composer update will not cross one:

Consumer	Constraint
devops_itksites	^5.1.1
economics	^4.0
display-api-service	^5.0

So the reader runs it, composer reports nothing to do, and they are left on 5.x wondering why none of the guide applies. grep '\^6\.0' UPGRADE-6.0.md returned nothing — the target version appeared nowhere in the document.

It now opens with composer require itk-dev/openid-connect-bundle:^6.0 and says why. The 4.x hop gets the same treatment, which is also where the partial-update refusal comes from.

Why the earlier pass missed it: I validated by pointing composer.json at a path repository, which replaces the constraint outright. That is a fine way to test the bundle and a poor way to test the guide. This time I followed the document literally.

The rest of the guide checks out

Both consumers walked end to end against develop:

economics (4.2.0 → 6.0, develop fast-forwarded to remote first): the documented 4.x refusal reproduced verbatim, and after naming both packages it needs no configuration change at all — the optional expiry date in #71 removed the one key it previously had to add. Container compiles in dev and prod, 431 tests and 19,246 assertions pass, callback path derives as /openid-connect/generic, and the unset expiry reports unknown.

devops_itksites (5.1.1 → 6.0, with its expiry key removed to match the pre-6.0 shape): compiles in dev and prod, 52 tests pass, nothing to change.

Steps 2 and 3 are no-ops for both: neither catches AuthenticationException around the callback nor overrides onAuthenticationFailure(), and neither references the removed exceptions.

Both repositories were restored afterwards — economics to 4.2.0 on its original branch with containers stopped as found, itksites to 5.1.1.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (dfeb91a) to head (1f4a6dd).

Additional details and impacted files

@@             Coverage Diff             @@
##             develop       #74   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       177       177           
===========================================
  Files             14        14           
  Lines            732       732           
===========================================
  Hits             732       732           

Flag	Coverage Δ
unittests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.