fix(composer-repository): encode the security advisory POST body as PHP does

`http_build_query(['packages' => array_keys($packageConstraintMap)])` maps a
single array value, so the body PHP sends is `packages%5B0%5D=a&packages%5B1%5D=b`.
The port flattened the array into repeated `packages=<name>` pairs, losing the
indices, and passed `"&"` as the numeric prefix and `"="` as the argument
separator, joining every pair with `=`.

Build the query from a `packages` key holding the name list and hand it to
`http_build_query_mixed`, which walks the nested value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 11 insertions, 12 deletions

diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 6a1b16ca..fe8faf48 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -41,7 +41,7 @@ use shirabe_pcre::{CaptureKey, Preg};
 use shirabe_php_shim::Catch as _;
 use shirabe_php_shim::{
     AnyThrowable, CmpOp, InvalidArgumentException, LogicException, PHP_EOL, PhpMixed,
-    RuntimeException, UnexpectedValueException, extension_loaded, hash, http_build_query,
+    RuntimeException, UnexpectedValueException, extension_loaded, hash, http_build_query_mixed,
     json_decode, parse_url_all, php_regex, realpath, strtolower, strtr, urlencode, var_export,
 };
 use shirabe_semver::CompilingMatcher;
@@ -1052,18 +1052,17 @@ impl ComposerRepository {
                 ));
                 http_map.insert("header".to_string(), PhpMixed::List(headers));
                 http_map.insert("timeout".to_string(), PhpMixed::Int(10));
-                let packages_list: Vec<(String, String)> = package_constraint_map
-                    .keys()
-                    .map(|k| ("packages".to_string(), k.clone()))
-                    .collect();
-                let body = http_build_query(
-                    &packages_list
-                        .iter()
-                        .map(|(k, v)| (k.as_str(), v.as_str()))
-                        .collect::<Vec<_>>(),
-                    "&",
-                    "=",
+                let mut query: IndexMap<String, PhpMixed> = IndexMap::new();
+                query.insert(
+                    "packages".to_string(),
+                    PhpMixed::List(
+                        package_constraint_map
+                            .keys()
+                            .map(|k| PhpMixed::String(k.clone()))
+                            .collect(),
+                    ),
                 );
+                let body = http_build_query_mixed(&query, "", "&");
                 http_map.insert("content".to_string(), PhpMixed::String(body));
             }