CI: disable Composer audit.block-insecure to ride out advisory waves

Three new symfony/yaml advisories landed on Packagist on 2026-05-20
(CVE-2026-45304, CVE-2026-45305, CVE-2026-45133), all flagging the
exact symfony/yaml version pinned by every MediaWiki branch in the
matrix (5.4.23 on REL1_39 through 5.4.45 on REL1_43, etc.). Composer's
`audit.block-insecure` default refuses to load the flagged version,
so `composer update` (and `composer install` inside installWiki.sh)
fails for every PR.

Disable `audit.block-insecure` globally before any composer step.
Same workaround as ProfessionalWiki/chameleon#480 and
ProfessionalWiki/NeoWiki#467, generalized so it covers both the
cached `composer update` path and the installWiki.sh path on cache
miss (via shared ~/.composer/config.json). Makes CI immune to
future advisory-vs-pinned-version churn against MW's exact symfony
pins, which is a recurring problem on EOL MW branches that don't
get the upstream `"audit": {"block-insecure": false}` backport.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: malberts

.github/workflows/ci.yml

@@ -62,6 +62,10 @@ jobs:
           extensions: mbstring, intl
           tools: composer
 
+      - name: Disable Composer block-insecure
+        working-directory: ~
+        run: composer config --global audit.block-insecure false
+
       - name: Cache MediaWiki
         id: cache-mediawiki
         uses: actions/cache@v4