fix(ci): skip composer advisory audit for integration test installs (#3950)

* fix(ci): skip composer advisory audit for framework integration test installs

A Packagist security advisory (PKSA-mdq4-51ck-6kdq / CVE-2026-48019, CRLF
injection in the default email validation rule) flags essentially all
Laravel framework versions this repo pins for integration tests
(>=9,<12.60.0 and >=13,<13.10.0). Composer's resolver refuses to load the
pinned versions, so every Laravel integration job fails during the composer
setup phase before any test runs.

These are intentionally pinned test fixtures, not shipped code, so disable
composer's resolver-level 'block-insecure' audit at the shared composer
invocation point (run_composer_with_retry). --no-audit only skips the
post-install audit report and does NOT lift the resolver block, so the
audit.block-insecure config must be set on the project being updated.

This is applied at the single shared point used by all framework/integration
composer installs, so it covers every affected Laravel version at once (and
harmlessly also covers other frameworks such as Symfony).

* fix(ci): tolerate composer audit config on Composer 2.2 (PHP < 7.2)

audit.block-insecure only exists since Composer 2.4; PHP 7.0/7.1 use the
Composer 2.2 LTS which rejects the setting and aborted every composer-driven
job. Composer 2.2 has no resolver block-insecure audit anyway, so ignore the
failure there with '|| true'.

Author: Leiyks

Makefile

@@ -1213,7 +1213,11 @@ MAX_RETRIES := 3
 RUN_WEB_BENCHES_WITH_DDPROF ?=
 
 # Note: The "composer show" command below outputs a csv with pairs of dependency;version such as "phpunit/phpunit;9.6.17"
+# Note: We disable composer's "block-insecure" audit so that pinned dependency versions flagged by a
+# security advisory still resolve. The audit.block-insecure setting only exists since Composer 2.4;
+# the Composer 2.2 LTS used for PHP < 7.2 has no such resolver block, so we ignore the failure there.
 define run_composer_with_retry
+	$(COMPOSER) --working-dir=$(if $1,$1,.) config audit.block-insecure false || true
 	for i in $$(seq 1 $(MAX_RETRIES)); do \
 		echo "Attempting composer update (attempt $$i of $(MAX_RETRIES))..."; \
 		$(COMPOSER) --working-dir=$(if $1,$1,.) update $2 && break || (echo "Retry $$i failed, waiting 5 seconds before next attempt..." && sleep 5); \