chore(ci): add Composer malware + advisory audit gate

Add a dedicated Composer Security workflow that runs `composer audit`
(Composer >= 2.10 fails on known malware and security advisories) on a
pinned toolchain, separate from the build/test pipeline. Runs on pushes
touching dependencies, on pull requests, and weekly via cron to catch
advisories newly published against an unchanged dependency set.

Also add a `config.policy` block to composer.json so the audit blocks on
malware and advisories while reporting (not failing) on abandoned
packages.

- actions pinned by commit SHA
- Composer pinned to 2.10
- read-only token (contents: read)

Author: leMaur

.github/workflows/composer-security.yml

@@ -0,0 +1,36 @@
+# managed-by: ComposerSecurityStamp (profile=oss) — edit the stamp, not this file
+name: Composer Security
+
+permissions:
+  contents: read
+
+on:
+  push:
+    paths:
+      - 'composer.json'
+      - '.github/workflows/composer-security.yml'
+  pull_request:
+  schedule:
+    - cron: '27 6 * * 1'  # weekly — catches deps newly flagged in an unchanged lockfile
+
+jobs:
+  audit:
+    name: Malware & advisory audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup PHP + pinned Composer
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
+        with:
+          php-version: '8.4'
+          tools: composer:2.10
+          coverage: none
+
+      - name: Resolve dependencies (library ships no lock)
+        run: composer update --prefer-dist --no-interaction --no-progress
+
+      - name: Audit (Composer >= 2.10 fails on malware + advisories)
+        run: composer audit

composer.json

@@ -49,13 +49,25 @@
             "pestphp/pest-plugin": true,
             "phpstan/extension-installer": true
         },
+        "policy": {
+            "advisories": {
+                "block": true
+            },
+            "malware": {
+                "block": true,
+                "block-scope": "all"
+            },
+            "abandoned": {
+                "audit": "report"
+            }
+        },
         "sort-packages": true
     },
     "scripts": {
         "post-autoload-dump": "composer normalize",
+        "analyse": "vendor/bin/phpstan analyse",
         "format": "vendor/bin/pint",
         "refactor": "vendor/bin/rector process",
-        "analyse": "vendor/bin/phpstan analyse",
         "test": "vendor/bin/pest",
         "test:coverage": "vendor/bin/pest --coverage",
         "test:type": "vendor/bin/pest --type-coverage --log-junit=build/type-coverage.xml"