Add PHP Composer ecosystem support

[bjcorder]

Problem

The scanner does not currently inspect PHP Composer manifests. Composer projects commonly rely on composer.json plus composer.lock, and can drift through version ranges, branch aliases, dev branches, or VCS dependencies that are not pinned to immutable commit refs.

Proposed behavior

Add conservative static Composer support.

Suggested rule shape:

• Ecosystem: php or composer.
• Include composer.json and use composer.lock as the companion lockfile.
• Parse require, require-dev, replace, provide, and repository/VCS dependency shapes where practical.
• Report a lockfile-required finding when package dependencies exist without composer.lock, subject to an ecosystem option.
• Flag non-deterministic constraints such as *, dev-main, branch aliases, broad ranges, and floating VCS refs.
• Allow exact versions with lockfile coverage and local path repositories when appropriate.
• Require full commit SHAs for git/VCS references when they appear in dependency declarations or repository metadata that the scanner can associate with a dependency.

Acceptance criteria

• Default discovery includes composer.json.
• The scanner reports missing lockfile findings for Composer projects with dependencies when lockfile policy is enabled.
• The scanner reports non-deterministic Composer version constraints and unpinned VCS refs.
• The scanner avoids findings in JSON comments are not applicable, unrelated strings, and unsupported metadata that cannot be tied to dependency resolution.
• Fixture coverage is added under __tests__/fixtures/php/ or __tests__/fixtures/composer/.
• Rule docs, ecosystem docs, README supported ecosystems, configuration docs, and schema are updated as needed.
• If runtime behavior changes, run npm run bundle and commit the updated dist/ output.