CI cannot resolve dependencies on PHP < 8.1 since Twig releases were flagged by security advisories

`composer update` fails on every PHP version below 8.1, so the four `PHPUnit (php, highest)` jobs for 7.2, 7.3, 7.4 and 8.0 cannot run. The last green CI run on `0.5.x` is from 30 March; the run of 13 June already failed this way, and every pull request opened since inherits a red check that has nothing to do with it.

## Cause

Composer blocks packages affected by a security advisory (`audit.block-insecure`, on by default). Every `twig/twig` release below 3.27 is flagged, and 3.27 requires PHP >= 8.1. The root constraint is `^2.9 || ^3.3`, so on PHP < 8.1 nothing is left:

```
Problem 1
- Root composer.json requires twig/twig ^2.9 || ^3.3 -> satisfiable by twig/twig[v3.27.0, v3.27.1, v3.28.0].
- twig/twig[v3.27.0, ..., v3.28.0] require php >=8.1.0 -> your php version (7.2.34) does not satisfy that requirement.
```

Forcing an older Twig shows what the first message hides:

```
$ composer update --dry-run --with "twig/twig:3.8.0"
- Root composer.json requires twig/twig ^2.9 || ^3.3, found twig/twig[v2.9.0, ..., v3.28.0]
but these were not loaded, because they are affected by security advisories (...)
```

Reproduced locally on `0.5.x` with `composer config platform.php`, Composer 2.9.5:

| platform php | `composer update` |
| --- | --- |
| 7.2.34 | fails |
| 7.4.33 | fails |
| 8.0.30 | fails |
| 8.1.31 | resolves |

## Possible fixes

1. Set `audit.block-insecure` to `false` for those jobs. Keeps the matrix and the supported range as they are; CI knowingly installs an old Twig on PHP versions that are themselves end of life.
2. Drop PHP < 8.1 from the matrix, and from `require.php`, which is a supported-versions decision.
3. Raise the constraint to `twig/twig ^3.27`, which amounts to the same thing through the back door.

I would go for the first one on `0.5.x` and leave the support range alone, but it is your call. Happy to send the PR for whichever you prefer.

Start with the root composer.json and the four PHPUnit (php, highest) CI jobs, then reproduce the dependency resolution using Composer 2.9.5 and the documented platform PHP versions. Confirm which of the three proposed fixes maintainers choose, then verify that the affected PHP matrix resolves and its checks pass without changing unrelated jobs.

Written by the indexing model from the issue text.