Add roave/security-advisories

[vitorbrandao]

From https://ocramius.github.io/blog/roave-security-advisories-protect-against-composer-packages-with-security-issues/:

roave/security-advisories is a composer package that prevents installation of packages with known security issues.

Benefits:

• No files or actual dependencies are added to the project, since a "metapackage" does not provide a vendor directory by itself
• Packages with security issues are filtered out during dependency resolution: they will not even be downloaded
• No more CLI tool to run separately, no more CI setup steps
• No need to upgrade the tool separately
• No coupling or version constraints with any dependencies used by similar CLI-based alternatives

[vitorbrandao]

Fixed by https://github.com/ppi/framework/pull/143.