feat: make event state constructor-only and immutable

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

tests/php/Unit/Event/SecurityEventTest.php

@@ -34,13 +34,35 @@ final class SecurityEventTest extends TestCase
     }
 
     #[Test]
-    #[TestDox('Explicit severity can override the event type default')]
+    #[TestDox('Construction can override the event type default severity')]
     public function allowsSeverityOverride(): void
     {
-        $event = new SecurityEvent(SecurityEvent::AUTH_FAILURE);
-
-        $event->setSeverity(SecurityEvent::SEVERITY_CRITICAL);
+        $event = new SecurityEvent(
+            SecurityEvent::AUTH_FAILURE,
+            severity: SecurityEvent::SEVERITY_CRITICAL,
+        );
 
         self::assertSame(SecurityEvent::SEVERITY_CRITICAL, $event->getSeverity());
     }
+
+    #[Test]
+    #[TestDox('Event state exposes no mutation methods')]
+    public function exposesNoMutationMethods(): void
+    {
+        foreach ([
+            'set',
+            'setTenantId',
+            'setIdentityId',
+            'setIpAddress',
+            'setDeviceFingerprint',
+            'setUserAgent',
+            'setRequestPath',
+            'setRequestMethod',
+            'setUserId',
+            'setReason',
+            'setSeverity',
+        ] as $method) {
+            self::assertFalse(method_exists(SecurityEvent::class, $method));
+        }
+    }
 }