Upgrade composer to 2.4

[jeffwidman]

composer 2.4 provides a couple of new options:

• audit is enabled by default for composer update, resulting in a bunch more API calls. For what we do this is unnecessary and we'll need to ensure it's disabled from the get go. This could be done using the COMPOSER_NO_AUDIT env var.
• bump may be a feature we can leverage. That can be done later though, so I broke that out separate in See if we can leverage composer 2.4's new bump feature #5719

Details:

• https://blog.packagist.com/composer-2-4/
• Add COMPOSER_NO_AUDIT constant ? shivammathur/setup-php#635
• https://github.com/composer/composer/releases/tag/2.4.0

See also:

• See if we can leverage composer 2.4's new bump feature #5719
• See if we can leverage composer's outdated command #5721

[jeffwidman]

Fixed by #5577.

Disabling audit was handled by #6503.