issues-35 | Add composer-audit security snippet

[prog-time]

Summary

Adds a composer-audit snippet to the security category — scans PHP/Composer dependencies for known vulnerabilities (CVEs) via composer audit.

Fills an obvious gap: the catalog already ships dependency-audit for Ruby (bundler-audit) and Python (pip-audit), but had no PHP/Composer equivalent. On a real Laravel project this immediately surfaces vulnerable transitive deps (e.g. a CVE in symfony/yaml).

Changes (follows the standard snippet convention)

• scripts/shell/security/composer-audit.sh — set -euo pipefail; guards presence of composer and composer.lock with ::error::; runs composer audit --abandoned=ignore (fails only on real advisories, not abandoned-package noise).
• tests/security/composer-audit.bats — covers: composer missing, no composer.lock, clean lock, vulnerable dependency (mirrors bundler-audit.bats).
• scripts/CI/security/composer-audit.yml — source job (run: bash scripts/shell/security/composer-audit.sh).
• CI/security/composer-audit.yml — assembled output.
• README.md — new row in the snippet catalog table.

Verification

• bats tests/security/composer-audit.bats → 4/4 pass.
• bash scripts/assemble-ci.sh scripts/CI/security scripts/shell/security CI/security regenerates cleanly — existing CI/security/*.yml unchanged (git diff on them empty); only the new file added.
• markdownlint README.md → clean.

Closes #35

---

The task was generated using the MCP server — prog-time/mcp-github-issues.