Move security advisory loading to repositories

[Seldaek]

• Allows other repos to provide security advisories
• Reduces load on packagist.org for summary advisory reports (which are done by default on update/install, and would have caused insane load on the packagist API otherwise)
• Disable automatic audit at the end of install step to keep things fast, switch --no-audit to an opt-in --audit flag

cc @GuySartorelli just FYI