Update Composer dependencies

[pierlon]

Summary

Updates:

• cweagans/composer-patches to ~1.0 (>=1.0.0 <2.0.0) (as requested by @swissspidy in Bump cweagans/composer-patches from 1.7.0 to 1.7.1 #6363 (comment))

• roave/security-advisories to dev-latest instead of dev-master as recommended by the maintainer

• Emulated PHP version (config.platform.php) to v5.6.20 to allow sabberworm/php-css-parser to be installed, otherwise when attempting install it would produce the error:

    Problem 1
  - Root composer.json requires sabberworm/php-css-parser dev-master#bfdd976 -> satisfiable by sabberworm/php-css-parser[dev-master].
  - sabberworm/php-css-parser dev-master requires php >=5.6.20 -> your php version (5.6; overridden via config.platform, actual: 7.2.34) does not satisfy that requirement.
  

  Update: Turns out this is because the composer config of the master branch is being locked and not the config in the bfdd976 commit. I think it might be a composer bug so I'll file a report.

Checklist

• My code is tested and passes existing tests.
• My code follows the Engineering Guidelines (updates are often made to the guidelines, check it out periodically).

[github-actions]

Plugin builds for 51036ad are ready 🛎️!

• Download development build
• Download production build

[pierlon]

Checking what's causing the PHP tests to fail...

[pierlon]

Looks like composer is locking the requirements of dev-master first, then checking out to bfdd976, causing a psr-4 namespace mismatch ("Sabberworm\\CSS\\": "src/" instead of "Sabberworm\\CSS\\": "lib/Sabberworm/CSS/") and thus not being able to autoload the library correctly.

[pierlon]

Tiktok embed test was failing earlier but all seems good now 😄.

[pierlon]

I've manually reverted the psr-4 path to lib/Sabberworm/CSS/ in 1c90850. This seems like a Composer bug so I'll report it.

[pierlon]

See composer/composer#9990.

[pierlon]

Turns out the behavior is as intended, as explained in composer/composer#9990 (comment). I'm not sure how to resolve this then since installing the dependency from the master branch is essentially broken now. Maybe we could fork it in the interim until a new release is made?

[westonruter]

Fork it in order to create a release tag to reference?

I hope that a new release of PHP-CSS-Parser will be made soon with all of the improvements being made recently.

[pierlon]

I made a Composer plugin as a method of patching the composer.lock file as well, but I'm not sure if we need to employ that as yet.

[westonruter]

😎 You're a composer whisperer.

[pierlon]

Opened a PR to add it: #6464.