fix(resolver): honor config.audit.block-insecure security-advisory filter

Mozart silently ignored the `security-advisories` block on inline
`type: package` repositories and the `config.audit.block-insecure`
audit flag, so a `composer update` succeeded with packages a Composer
run would have refused to load. Mirror Composer's
`SecurityAdvisoryPoolFilter` for the slice that feeds the pool:

- Plumb a `security-advisories` field through `RawRepository` and a
  `block_insecure` flag through `ResolveRequest`, lifted off
  `composer.json`'s `config.audit.block-insecure`.
- Collect every advisory's `affectedVersions` constraint at resolve
  time. When `block_insecure` is set and an inline package's
  normalized version satisfies the constraint, drop it from the pool
  before solving — root requires with no unaffected candidate then
  fail with the standard "could not be resolved" error.

1 files changed, 3 insertions, 0 deletions

diff --git a/crates/mozart/src/commands/require.rs b/crates/mozart/src/commands/require.rs
index 3ff5ced..b302ed9 100644
--- a/crates/mozart/src/commands/require.rs
+++ b/crates/mozart/src/commands/require.rs
@@ -667,6 +667,7 @@ pub async fn execute(
         block_abandoned: false,
         root_branch_alias: None,
         preferred_versions: indexmap::IndexMap::new(),
+        block_insecure: false,
     };
 
     // Print header messages
@@ -1079,6 +1080,7 @@ mod tests {
             block_abandoned: false,
             root_branch_alias: None,
             preferred_versions: indexmap::IndexMap::new(),
+            block_insecure: false,
         };
 
         let resolved = resolver::resolve(&request)
@@ -1158,6 +1160,7 @@ mod tests {
             block_abandoned: false,
             root_branch_alias: None,
             preferred_versions: indexmap::IndexMap::new(),
+            block_insecure: false,
         };
 
         let resolved = resolver::resolve(&request)