Composer 2.6, and audit as a pipeline step

The audit command has been there since 2.4 and had never been run by anything except a person remembering to run it.

# in CI, and the flags that make it usable
composer audit --locked --format=json > audit.json

# --locked reads composer.lock rather than the installed tree,
# so it runs without a full install

# the first run:
#   4 advisories, 2 in dev dependencies
#   1 in a package we no longer use and had not removed
#   1 real, in an HTTP client, fixed by a patch bump

Two of the four were noise in the sense that they could not be reached from production code, and the way to keep that from making the whole step ignorable is the abandoned-package check that comes with it — the advisory that led us to a package nobody had used since 2021 was worth more than the fix. Running it on the lock file rather than the vendor directory is what makes it fast enough to be unconditional.