feat(ci): add composer audit to CI pipeline

[Litarnus]

This PR changes the workflow to increase dependency resilience. Instead of running composer update directly, we will first create the composer.lock file without installing, then run composer audit on it and only continue with installing once the audit passes.

Abandoned dependencies will not trigger a hard error for --prefer-lowest, but they will for highest tests