Make composer process timeout configurable via .drupal-updater.yml

[AndrewGearhart]

Composer operations can exceed the current hard-coded 300s process timeout, causing updates to fail in larger projects and/or CI.
Even if COMPOSER_PROCESS_TIMEOUT is set, the Symfony Process timeout in UpdaterCommand kills the process first.

Current Behavior

• All shell commands run with a fixed 300s timeout.
• Long-running composer commands (e.g., dependency resolution, network slowness, composer why -r) can time out.

Impact

• Larger dependency graphs and slower CI/network environments.
• Security audits and updates occasionally exceed 300s, producing false negatives/failures.

Proposed Change

• Add composerTimeout (int, seconds, default 300) to .drupal-updater.yml.
• When running composer commands:
• Set Symfony Process timeout to composerTimeout.
• Set COMPOSER_PROCESS_TIMEOUT env to the same value so composer aligns with the process timeout.
• Keep non-composer commands at the existing 300s default.
• Respect explicit shell-wrapped timeouts (e.g., timeout 2 composer …) without overriding them.
• Document composerTimeout in README.

Example Configuration

composerTimeout: 1800

Backward Compatibility

• Default remains 300s; no change unless users set composerTimeout.
• Only composer invocations are affected.

Alternatives Considered

• Global process timeout option (affect all commands) — riskier change in behavior.
• Environment-only approach — not sufficient because Symfony Process still enforces its 300s timeout.
• CLI flags (--composer-timeout) — could be added later, but YAML config covers persistent use cases.

Acceptance Criteria

• Composer commands honor a configurable timeout from .drupal-updater.yml.
• Without configuration, behavior matches current default (300s).
• README documents the new option.

References

• WIP branch with proposed implementation: https://github.com/AndrewGearhart/drupal-updater/tree/feature-config-composer-timeout