Document Composer 2.9's security constraints

[stevector]

As of Composer 2.9

Composer now automatically blocks updates to packages with known security advisories. This protection is enabled by default and prevents you from accidentally updating to vulnerable package versions. You can configure this behavior via the new audit.block-insecure config settings if needed.

We should update some section of our documentation to draw attention to the workaround for those who need it:

this can be added to Composer.json.

"config": {
  "audit": {
    "block-insecure": false
  }

This question was tracked internally as https://getpantheon.atlassian.net/browse/BUGS-10681