Audit committed composer.lock files for security advisories - #311

Closes #310.

Composer refuses vulnerable versions when it resolves dependencies, but not when it installs from a committed lock file. wp-cli-bundle builds the Phar from its composer.lock, so an advisory published after a dependency was locked would otherwise go unnoticed.

This adds a composer-audit job to the shared code quality workflow. It runs only where a composer.lock is committed (wp-cli-bundle and wp-cli/dashboard today), as a job of its own like the other checks, so an advisory never looks like a lint failure. It uses each repository's existing triggers, so wp-cli-bundle gets it on pull requests, on pushes and nightly at 02:17 UTC. Nightly runs wait a random delay of up to 20 minutes to spread the load on Packagist.

Abandoned packages are reported without failing the job, because wp-cli-bundle locks the abandoned behat/transliterator. Against wp-cli-bundle's current lock, the audit command finds no advisories and passes.