[1.x] [workflows] fix: peg composer at 2.8.x to avoid security blocking, etc in 2.9

[imorland]

Fixes #0000

Changes proposed in this pull request:
Composer now automatically blocks updates to packages with known security advisories. This is a problem for some of 1.x's deps, especially laminas.

To prevent CI failures, this pegs composer to 2.8.x (ie before these changes were introduced).

The other option is to add audit.block-insecure: false in composer.json, but this would not be helpful for currently released Flarum versions.

The changes here are not needed for 2.x

More information: https://blog.packagist.com/composer-2-9/

Reviewers should focus on:

Screenshot

Necessity

• Has the problem that is being solved here been clearly explained?
• If applicable, have various options for solving this problem been considered?
• For core PRs, does this need to be in core, or could it be in an extension?
• Are we willing to maintain this for years / potentially forever?

Confirmed

• Frontend changes: tested on a local Flarum installation.
• Backend changes: tests are green (run composer test).
• Core developer confirmed locally this works as intended.
• Tests have been added, or are not appropriate here.

Required changes:

• Related documentation PR: (Remove if irrelevant)