chore: align package metadata and CI with the other Cyllene plugins

[JDCyllene]

What this pull request does

Aligns the package metadata and the CI with SyliusAdvancedTaxonPlugin.

• composer.json gains homepage, authors and support (issues, source, security policy), so Packagist links back to the repository and to SECURITY.md.
• Both workflows run with a read-only token (permissions: contents: read), on a pinned ubuntu-24.04 image and with a timeout, instead of the 6-hour default.
• Third-party actions are pinned by commit SHA: SyliusLabs/BuildTestAppAction v4.3.0 and shivammathur/setup-php 2.37.2.
• The security audit also resolves the oldest supported line (Sylius 2.2 on PHP 8.3, hence Symfony 7.4), not only the newest one.

The rest of the build matrix is unchanged.

Points to watch

• Tests pass (vendor/bin/phpunit), checked locally against Sylius 2.3.0 and sylius/test-application 2.3.0-ALPHA.4
• PHPStan and ECS are green
• UPGRADE.md is up to date if the public surface changes (no public surface change)