Request: validate composer, package.json

Please add a test for `composer validate`
If package.json exists, run `npm audit`
Check that `roave/security-advisories: dev-master` is in composer.json
It should be the only package as dev-master, which can affect `composer validate`
Composer Validate should handle semver checking, but you may wish to roll your own, to accommodate user configurable checks for these prefix/suffixes:
* ^1.2.3
* ~1.2.3
* 1.2.*
Of course, Composer Validate does much more, including composer.lock checks.

Start by inspecting the existing test structure, composer.json, and package.json to find how dependency checks are currently handled. Add coverage for composer validate, npm audit when package.json exists, the roave/security-advisories dev-master constraint, and the listed version patterns; done means these checks and configurable prefix/suffix cases are tested.

Written by the indexing model from the issue text.