"drush sec" could give better guidance when using drupal/core-recommended

[prudloff-insite]

Describe the bug
When using drupal/core-recommended instead of drupal/core, drush sec still recommends running composer require drupal/core. However, this command will do nothing because the version of drupal/core is locked to the specific version required by drupal/core-recommended.

To Reproduce
Run composer require drupal/core-recommended:10.0.7.
drush sec now says this:

Try running: composer require drupal/core --update-with-dependencies

Running this command does not update drupal/core because drupal/core-recommended requires drupal/core 10.0.7.
composer require drupal/core-recommended --update-with-dependencies would need to be used instead.

Expected behavior
I guess Drush could detect if core-recommended is used and recommend updating it instead of core.

Actual behavior
Drush asks the user to run a Composer command that does nothing.

Workaround
If the user is aware of this problem, they can adapt the command themself.

System Configuration

Q	A
Drush version?	11.6.0
Drupal version?	10.0.7
PHP version	8.2.3
OS?	Linux Mint 21

Additional information
We are using drush sec --format json in an automated CI script so if we wanted to use core-recommended, we would have to alter the JSON output so that our script updates the right package.

[weitzman]

I think checking for core-recommended and specifying that in this case makes sense.