Activate composer audit by default (instead of roave security advisories)

[veewee]

See https://php.watch/articles/composer-audit

Composer audit works in a less blocking way than roave/security-advisories.
It can be used on all of our local development setups by default without having additional dependencies.

Changed:

• Moved to composer audit instead of roave/security advisories
• Enabled security check by default now that it does not require an additional 3rd party package.

Make sure you are on composer >2.4:

kevin composer self-update --stable

(Or upgrade to your latest PHP image with kevin pull)

You might want to avoid failing on usage of deprecated packages (if for example your framework relies on them):

// composer.json

{
    "config": {
        "audit": {
            "abandoned": "report"
        }
    }
}