CI: audit composer lock file with --locked on main

Matches develop and upstream devops_itkdev-docker#143; the CI container has
no installed vendor/, so audit the committed lock file directly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: turegjorup

.github/workflows/composer.yaml

@@ -76,4 +76,4 @@ jobs:
                   docker network create frontend
 
             - run: |
-                  docker compose run --rm phpfpm composer audit
+                  docker compose run --rm phpfpm composer audit --locked