chore(ci): drop composer.lock, group security updates, harden workflows

[ManukMinasyan]

Clears 51 of 60 open Dependabot alerts and all 10 code scanning alerts, and unbreaks the composer updater.

composer.lock

Removed. Nothing read it:

• Consumers resolve their own dependencies. Composer's docs: "this lock file will not have any effect on other projects that depend on it."
• .gitattributes already carried composer.lock export-ignore, so it never shipped in the dist tarball.
• tests.yml installs with composer require --no-update + composer update, never composer install.
• grep -rn composer.lock bin/ src/ .github/ config/ database/ stubs/ tests/ returns nothing.

Its only observable effect was 51 Dependabot alerts, every one of them in a file no user of this package ever reads.

Why the composer updater has been silent

The composer ecosystem was restored to dependabot.yml on 2026-08-19 and has opened zero PRs since. Security updates, which ignore both cooldown and open-pull-requests-limit, have opened zero since the first composer alert on 2026-05-27.

dependabot-core copies require.php into config.platform.php (lockfile_updater.rb#initial_platform), so ^8.3 became a hard 8.3. The lock held symfony 8 packages requiring PHP >= 8.4. Reproduced locally with Composer 2.10.2, the version Dependabot ships:

$ composer update league/commonmark --with-all-dependencies --dry-run   # config.platform.php = "8.3"
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - nunomaduro/collision is locked to version v8.9.4 and an update of this package was not requested.
    - nunomaduro/collision v8.9.4 requires symfony/console ^7.4.8 || ^8.0.8 -> satisfiable by symfony/console[v8.0.8].
    - symfony/console v8.0.8 requires php >=8.4 -> your php version (8.3; overridden via config.platform, actual: 8.5.8) does not satisfy that requirement.

dependabot-core is meant to retry with a higher PHP version here, but the two files implementing that retry disagree: version_resolver.rb matches (?<=require\s)php, lockfile_updater.rb matches (?<=requires\s)php. Composer emits "requires php", so the update checker's branch never fires and the job errors before the lockfile updater runs. The ext-* branch of the same regex is unaffected, which is why missing-extension retries still work.

Without the lock, the full tree resolves at platform 8.3 (193 installs, no conflict), so "php": "^8.3" stays accurate and is unchanged here.

dependabot.yml

Each ecosystem gets a security-updates group alongside its existing group. applies-to defaults to version updates, which is why #211, #212 and #213 each arrived as a separate PR.

Workflows

Clears all 6 artipacked and all 4 template-injection findings. Verified with zizmor --no-online-audits on this branch against 3.x: 6 warnings + 4 infos before, 0 after, nothing new introduced.

• tests.yml and the source checkout in deploy-docs.yml never push, so they get persist-credentials: false.
• The four checkouts whose credential is deliberately used for a later push (gh-pages deploy, two git-auto-commit-action steps, the tag cleanup) carry an inline ignore naming the push.
• Step outputs move out of run: bodies into env:.

Also done outside this PR

allow_auto_merge was off at the repo level, so auto-merge.yml failed on every Dependabot PR with Auto merge is not allowed for this repository. Now enabled.

One caveat worth deciding separately: a merge enabled with GITHUB_TOKEN does not trigger on: push workflows, and deploy-docs.yml is on: push with paths: docs/**. Auto-merged docs bumps would stop redeploying the docs site until that uses a GitHub App token or a scheduled redeploy.

4.x and feat/4.0 carry their own composer.lock and need the same treatment, or the file returns at the next merge.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.