perf(advisory): share AnySecurityAdvisory via Rc

PHP's SecurityAdvisoryPoolFilter stores advisory *object references* in
$securityRemovedVersions, and PoolOptimizer::applyRemovalsToPool hands
that array to the new Pool by copy-on-write. Porting AnySecurityAdvisory
as a value type turned both of those into deep copies.

Measured on `require laravel/framework` (offline, warm cache): 113
distinct advisories were duplicated into 314,309 copies of ~1.08 KiB,
retaining 331.9 MiB in the filter loop and another 331.9 MiB when
apply_removals_to_pool cloned the whole map.

3.54s -> 2.62s (-26%), peak RSS 975 MB -> 343 MB, which matches the upper
bound measured by ablation. Composer runs the same workload in 1.49s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 6 insertions, 4 deletions

diff --git a/crates/shirabe/src/repository/repository_set.rs b/crates/shirabe/src/repository/repository_set.rs
index c407a1ce..8443400f 100644
--- a/crates/shirabe/src/repository/repository_set.rs
+++ b/crates/shirabe/src/repository/repository_set.rs
@@ -363,8 +363,9 @@ impl RepositorySet {
         allow_partial_advisories: bool,
         ignore_unreachable: bool,
         unreachable_repos: &mut Vec<String>,
-    ) -> anyhow::Result<IndexMap<String, Vec<AnySecurityAdvisory>>> {
-        let mut repo_advisories: Vec<IndexMap<String, Vec<AnySecurityAdvisory>>> = vec![];
+    ) -> anyhow::Result<IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> {
+        let mut repo_advisories: Vec<IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>> =
+            vec![];
         for repository in &self.repositories {
             let attempt: anyhow::Result<()> = (|| -> anyhow::Result<()> {
                 let mut repo_ref = repository.borrow_mut();
@@ -403,7 +404,8 @@ impl RepositorySet {
             }
         }
 
-        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
+        let mut advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>> =
+            IndexMap::new();
         for repo in repo_advisories {
             for (name, list) in repo {
                 advisories.entry(name).or_default().extend(list);
@@ -672,6 +674,6 @@ impl RepositorySetInterface for RepositorySet {
 
 #[derive(Debug)]
 pub struct SecurityAdvisoriesResult {
-    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<std::rc::Rc<AnySecurityAdvisory>>>,
     pub unreachable_repos: Vec<String>,
 }