perf(advisory): share AnySecurityAdvisory via Rc

PHP's SecurityAdvisoryPoolFilter stores advisory *object references* in
$securityRemovedVersions, and PoolOptimizer::applyRemovalsToPool hands
that array to the new Pool by copy-on-write. Porting AnySecurityAdvisory
as a value type turned both of those into deep copies.

Measured on `require laravel/framework` (offline, warm cache): 113
distinct advisories were duplicated into 314,309 copies of ~1.08 KiB,
retaining 331.9 MiB in the filter loop and another 331.9 MiB when
apply_removals_to_pool cloned the whole map.

3.54s -> 2.62s (-26%), peak RSS 975 MB -> 343 MB, which matches the upper
bound measured by ablation. Composer runs the same workload in 1.49s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 4 insertions, 4 deletions

diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs
index 7f61bc9e..3397f071 100644
--- a/crates/shirabe/src/repository/package_repository.rs
+++ b/crates/shirabe/src/repository/package_repository.rs
@@ -211,7 +211,7 @@ impl AdvisoryProviderInterface for PackageRepository {
     ) -> anyhow::Result<SecurityAdvisoryResult> {
         let parser = VersionParser::new();
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories = IndexMap::new();
         for (package_name, package_advisories) in &self.security_advisories {
             let Some(package_constraint) = package_constraint_map.get(package_name) else {
                 continue;
@@ -221,7 +221,7 @@ impl AdvisoryProviderInterface for PackageRepository {
                 PhpMixed::List(list) => list,
                 _ => continue,
             };
-            let mut items: Vec<AnySecurityAdvisory> = Vec::new();
+            let mut items: Vec<std::rc::Rc<AnySecurityAdvisory>> = Vec::new();
             for data in list {
                 let data_map: IndexMap<String, PhpMixed> = match data {
                     PhpMixed::Array(m) => m.clone(),
@@ -249,13 +249,13 @@ impl AdvisoryProviderInterface for PackageRepository {
                     continue;
                 }
 
-                items.push(advisory);
+                items.push(std::rc::Rc::new(advisory));
             }
             advisories.insert(package_name.clone(), items);
         }
 
         let names_found: Vec<String> = advisories.keys().cloned().collect();
-        let advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = advisories
+        let advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> = advisories
             .into_iter()
             .filter(|(_, adv)| !adv.is_empty())
             .collect();