Add an allowed-to-fail `rector --dry-run` CI job

[oliverklee]

We want to be able to check if a Rector update breaks anything (or introduces new code changes which we'd like to apply).