ci: add composer audit security workflow

[roxblnfk]

Q	A
Bugfix?	❌
Breaks BC?	❌
New feature?	❌
Issues	—

• Adds a 🔐 Security analysis workflow that runs composer audit on PRs and pushes to 1.x (PHP 8.1, highest dependencies).
• Ignores GHSA-g9pc-8g42-g6vq in config.audit.ignore: it is declared for spiral/roadrunner < 2025.1.0, and by semver that range also matches RoadRunner 3.x, which is not affected.

Checked locally with a PHP 8.1 platform: composer update + composer audit pass (only the ignored advisory is reported).

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a0b0ce32-8281-488a-9b7a-3df3f747c249

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}