Repair wp/5.6 branch Actions: Configure the Composer advisory policy - #84966

Part of #82937.

What?

Adds config.policy.advisories.ignore-id to composer.json for one advisory, with the reason it doesn't apply recorded in the entry itself.

Why?

PKSA-mh9b-91zm-m1gy (CVE-2026-45293) is an eval() injection in wp-coding-standards/wpcs' WordPress.WP.EnqueuedResourceParameters sniff. It covers every release allowed by ^2.2 (2.2.0, 2.2.1, 2.3.0), so any Composer command that resolves dependencies fails:

Problem 1
  - Root composer.json requires wp-coding-standards/wpcs ^2.2, found
    wp-coding-standards/wpcs[2.2.0, 2.2.1, 2.3.0] but these were not loaded,
    because they are affected by security advisories ("PKSA-mh9b-91zm-m1gy").

The sniff is only in the WordPress and WordPress-Extra rulesets. phpcs.xml.dist uses WordPress-Core, WordPress-Docs and individually named sniffs, so it never loads.

CI installs from composer.lock, which skips the advisory check. But composer update, require or remove under a current Composer hit it, and the wp-env composer service runs the composer:2 image (#84965), which follows every Composer 2 release. Keeping the reason in the ignore entry matches the other wp/X.Y branches.

Testing

Composer 2.10.3 (composer image, PHP 8.5.10), this branch's composer.json and composer.lock, judged by exit status:

No other advisory blocks resolution.

Use of AI Tools

This PR was created by Claude Code under my supervision. All code should be treated as AI-produced and not yet reviewed by a human until this PR is marked Ready for Review.