Don't block installs on security advisories (#904)

Dependencies in this repository are only used locally to build the
docs and are never deployed, so advisories are reported instead of
blocking composer update. Malware blocking keeps its default.

Author: W0rma

composer.json

@@ -43,6 +43,12 @@
       "ext-mongodb": "1.21.2",
       "ext-phalcon": "4.1.1"
     },
+    "policy": {
+      "advisories": {
+        "block": false,
+        "audit": "report"
+      }
+    },
     "allow-plugins": {
       "php-http/discovery": true
     }