Document Composer 2.9's security constraints

As of Composer 2.9 > Composer now automatically blocks updates to packages with known security advisories. This protection is enabled by default and prevents you from accidentally updating to vulnerable package versions. You can configure this behavior via the new audit.block-insecure [config settings](https://getcomposer.org/doc/06-config.md#audit) if needed. We should update some section of our documentation to draw attention to the workaround for those who need it: this can be added to Composer.json. ``` "config": { "audit": { "block-insecure": false } ``` This question was tracked internally as https://getpantheon.atlassian.net/browse/BUGS-10681