perf(advisory): share AnySecurityAdvisory via Rc

PHP's SecurityAdvisoryPoolFilter stores advisory *object references* in
$securityRemovedVersions, and PoolOptimizer::applyRemovalsToPool hands
that array to the new Pool by copy-on-write. Porting AnySecurityAdvisory
as a value type turned both of those into deep copies.

Measured on `require laravel/framework` (offline, warm cache): 113
distinct advisories were duplicated into 314,309 copies of ~1.08 KiB,
retaining 331.9 MiB in the filter loop and another 331.9 MiB when
apply_removals_to_pool cloned the whole map.

3.54s -> 2.62s (-26%), peak RSS 975 MB -> 343 MB, which matches the upper
bound measured by ablation. Composer runs the same workload in 1.49s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/crates/shirabe/src/dependency_resolver/pool.rs b/crates/shirabe/src/dependency_resolver/pool.rs
index adf42f54..a9dffe71 100644
--- a/crates/shirabe/src/dependency_resolver/pool.rs
+++ b/crates/shirabe/src/dependency_resolver/pool.rs
@@ -28,7 +28,8 @@ pub struct Pool {
     /// @var array<string, array<string, string>> Map of package object hash => removed normalized versions => removed pretty version
     pub(crate) removed_versions_by_package: IndexMap<String, IndexMap<String, String>>,
     /// @var array<string, array<string, array<SecurityAdvisory|PartialSecurityAdvisory>>> Map of package name => normalized version => security advisories
-    security_removed_versions: IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>>,
+    security_removed_versions:
+        IndexMap<String, IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>>,
     /// @var array<string, array<string, string>> Map of package name => normalized version => pretty version
     abandoned_removed_versions: IndexMap<String, IndexMap<String, String>>,
 }
@@ -45,7 +46,10 @@ impl Pool {
         unacceptable_fixed_or_locked_packages: Vec<BasePackageHandle>,
         removed_versions: IndexMap<String, IndexMap<String, String>>,
         removed_versions_by_package: IndexMap<String, IndexMap<String, String>>,
-        security_removed_versions: IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>>,
+        security_removed_versions: IndexMap<
+            String,
+            IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
+        >,
         abandoned_removed_versions: IndexMap<String, IndexMap<String, String>>,
     ) -> Self {
         let mut this = Self {
@@ -182,7 +186,7 @@ impl Pool {
     /// @return array<string, array<string, array<SecurityAdvisory|PartialSecurityAdvisory>>>
     pub fn get_all_security_removed_package_versions(
         &self,
-    ) -> &IndexMap<String, IndexMap<String, Vec<AnySecurityAdvisory>>> {
+    ) -> &IndexMap<String, IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> {
         &self.security_removed_versions
     }