Hotfix 1.2.4: fix composer audit

[turegjorup]

Hotfix 1.2.4: fix the failing composer-audit check by auditing the lock file and updating only the packages with security advisories.

Changes

• composer-audit workflow runs composer audit --locked, so it audits composer.lock rather than whatever is installed in the CI container.

• Scoped composer update of the flagged packages only:

  Package	From	To
  api-platform/core	v4.1.28	v4.1.30
  guzzlehttp/guzzle	7.10.3	7.15.5
  guzzlehttp/psr7	2.8.1	2.13.1
  symfony/http-foundation	v7.4.8	v7.4.20
  symfony/routing	v7.4.12	v7.4.20
  symfony/security-http	v7.4.12	v7.4.20
  twig/twig	v3.26.0	v3.30.0
  guzzlehttp/promises	2.3.1	2.5.3

  guzzlehttp/promises is not flagged itself; the fixed Guzzle releases require ^2.5.1, so it has to move with it. No composer.json constraints changed, and no other packages changed in the lock file.

Why

composer-audit fails on main (e.g. run 37589828460), which blocks hotfixes such as #63. composer audit --locked reports 3 high and 20 medium/low advisories across these packages; after the update it reports none. Tests (19) and PHPStan pass locally.

[github-actions]

✅ No changes detected in API specification