fix: resolve v1.0 release blockers

[maartenbode]

Hardening and fixes required before tagging v1.0. Scope is release blockers only.

Hardening

• Stricter validation of repository identifiers and mirror URLs, applied both at request validation and at the point of use.
• Organization scoping when selecting an SSH key for a repository.
• Restrictions on the targets of server-side fetches, with OUTBOUND_ALLOWED_HOSTS to permit internal Git servers and registries.
• Redaction of credentials in sync log output and error reports.
• Rate limiting for the Composer API and webhook endpoints, configurable via RATE_LIMIT_*.
• Unique index on access_tokens.token_hash, and far fewer writes on the token path.

Fixes

• packages.json now advertises the advisory endpoint, so composer audit discovers it. It previously did not, leaving the endpoint unreachable by the client it was built for.
• The container healthcheck now exercises the application and its dependencies instead of being answered by the web server, so horizon, scheduler and reverb no longer start against a broken app.
• TRUSTED_PROXIES now survives config:cache. Behind a TLS-terminating proxy it was silently lost, downgrading generated URLs to http.
• CI runs against MySQL 8 and PostgreSQL 16 alongside SQLite. Both are supported but neither was exercised; expect this to surface real failures on the first run.
• Added SECURITY.md and reconciled the security contact, which differed between the README and CONTRIBUTING.

Notes

• Two static-analysis fixes (MetadataController, V2RegistryClient) are outside the stated scope; they were needed to keep the tree green. They are isolated in their own commit.
• AccessToken.scopes and Package.visibility remain unused by deliberate decision. Tokens grant organization-wide read access.
• Unrelated to this branch: some tests make real network calls, which makes the suite hang when the network is slow.