Don't let Composer advisory blocking break CI

Composer 2.10 blocks installing packages affected by an active security
advisory. When Symfony deps have an advisory but no patched release yet,
dependency resolution fails and CI turns red with nothing actionable in
the bundle itself. Disable advisory blocking for the test job.

Author: Kocal

.github/workflows/ci.yml

@@ -58,6 +58,11 @@ jobs:
       - name: Configure Composer minimum stability
         run: composer config minimum-stability ${{ matrix.minimum-stability || 'stable' }} --ansi
 
+      # Symfony deps may temporarily have no advisory-free release (unpatched CVE upstream);
+      # don't let Composer's advisory blocking turn the bundle's CI red in the meantime.
+      - name: Disable Composer security advisories blocking
+        run: composer config --no-plugins policy.advisories.block false
+
       - name: "Composer install"
         uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6
         with: