GHSA-rvx4-ffvw-m9q3: Composer arbitrary command execution via a malicious package's Perforce source URL

## Summary If the `p4` Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs (packagist.org is safe) could execute arbitrary commands when running `composer install` or `composer update`. Composer passed a package's Perforce source address to the `p4` CLI client without validating it. The `p4` CLI client accepts addresses that mean "run this local command" instead of "connect to this server". This is remote code execution with the privileges of the user or CI account running Composer. ## Am I affected? …