Fix CI: audit lock file, regenerate API spec, changelog 1.11.1 section

- composer-audit: pass --locked so the audit runs against the committed
  lock file (CI container has no installed vendor/)
- Regenerate public/api-spec-v1.yaml for Symfony YAML 8.1 dumper formatting
- Move the 1.11.1 hotfix entry (#84) into a ## [1.11.1] section so the
  [1.11.1] link reference is used (fixes markdownlint MD053)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: turegjorup

.github/workflows/composer.yaml

@@ -76,4 +76,4 @@ jobs:
                   docker network create frontend
 
             - run: |
-                  docker compose run --rm phpfpm composer audit
+                  docker compose run --rm phpfpm composer audit --locked

CHANGELOG.md

@@ -14,9 +14,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - [#81](https://github.com/itk-dev/devops_itksites/pull/81) 5564: Asset Mapper migration
   - Add Symfony Asset Mapper bundle and importmap
 
-- [#84](https://github.com/itk-dev/devops_itksites/pull/84)
-  Update composer dependencies. Fix for Symfony and Twig CVE's
-
 - [#85](https://github.com/itk-dev/devops_itksites/pull/85)
   Update openid-connect-bundle to 5.0 and Symfony to 8.1
   - Bump `itk-dev/openid-connect-bundle` to `^5.0` (pulls `itk-dev/openid-connect` 5.0)
@@ -25,6 +22,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     extend `ItkOpenIdConnectException`)
   - Update Symfony to 8.1
 
+## [1.11.1] - 2026-06-01
+
+- [#84](https://github.com/itk-dev/devops_itksites/pull/84)
+  Update composer dependencies. Fix for Symfony and Twig CVE's
+
 ## [1.11.0] - 2026-05-19
 
 - [#78](https://github.com/itk-dev/devops_itksites/pull/78)

public/api-spec-v1.yaml

@@ -4,8 +4,7 @@ info:
   description: 'REST API for ingesting server detection results from the ITK sites server harvester. Detection results are processed asynchronously to track servers, sites, domains, packages, modules, Docker images, and git repositories.'
   version: 1.0.0
 servers:
-  -
-    url: 'https://itksites.local.itkdev.dk'
+  - url: 'https://itksites.local.itkdev.dk'
     description: ''
 paths:
   /api/detection_results:
@@ -16,7 +15,7 @@ paths:
       responses:
         '202':
           description: 'Detection result accepted for processing'
-          links: {  }
+          links: {}
         '400':
           description: 'Invalid input — malformed request body'
           content:
@@ -29,7 +28,7 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Error'
-          links: {  }
+          links: {}
         '401':
           description: 'Unauthorized — missing or invalid API key. The Authorization header must use the format: Apikey {key}'
         '403':
@@ -46,7 +45,7 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/ConstraintViolation'
-          links: {  }
+          links: {}
       summary: 'Submit a detection result for async processing'
       description: 'Accepts a detection result from the server harvester and queues it for asynchronous processing. The result is deduplicated by content hash — identical submissions update the last contact timestamp without triggering reprocessing. Returns 202 Accepted with an empty body.'
       parameters: []
@@ -251,11 +250,11 @@ components:
           type:
             - string
             - 'null'
-  responses: {  }
-  parameters: {  }
-  examples: {  }
-  requestBodies: {  }
-  headers: {  }
+  responses: {}
+  parameters: {}
+  examples: {}
+  requestBodies: {}
+  headers: {}
   securitySchemes:
     apiKey:
       type: apiKey
@@ -266,7 +265,6 @@ security:
   -
     apiKey: []
 tags:
-  -
-    name: DetectionResult
+  - name: DetectionResult
     description: "Resource 'DetectionResult' operations."
-webhooks: {  }
+webhooks: {}