Install dependencies before composer audit in CI

The composer-audit workflow job ran `composer audit` with no prior
install. Because this bundle does not commit composer.lock, the audit
had no resolved dependency set to scan. Add a `composer install` step
first (mirroring the composer-normalized job) so the audit runs against
the actually-resolved packages.

Note: .github/workflows/composer.yaml is generated from
itk-dev/devops_itkdev-docker; this fix should be upstreamed there too,
or it will be lost on the next workflow sync.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: turegjorup

.github/workflows/composer.yaml

@@ -80,4 +80,5 @@ jobs:
           docker network create frontend
 
       - run: |
+          docker compose run --rm phpfpm composer install
           docker compose run --rm phpfpm composer audit