ci: run composer audit instead of roave/security-advisories

[roxblnfk]

Q	A
Bugfix?	❌
Breaks BC?	❌
New feature?	❌
Issues	—

• The security workflow now runs composer audit on PHP 8.2 with the highest dependencies instead of requiring roave/security-advisories:dev-latest at CI time.
• The workflow follows the shared layout used in testo: concurrency groups that cancel superseded PR runs, ramsey/composer-install, strict composer validate.
• The package does not depend on spiral/roadrunner, so no advisory ignore for GHSA-g9pc-8g42-g6vq is needed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 730705a5-1e08-4085-b84a-d15c3426e24d

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}