Security-checker - fix testing security-checker in ci

https://github.com/EdgedesignCZ/phpqa/pull/215/checks?check_run_id=1830905399
- Package enlightn/security-checker at version has a PHP requirement incompatible with your PHP version (5.4.45)

https://github.com/EdgedesignCZ/phpqa/pull/215/checks?check_run_id=1830905455
https://github.com/EdgedesignCZ/phpqa/runs/1838836954?check_suite_focus=true#step:5:130
- enlightn/security-checker v1.4 requires ext-zip * -> the requested PHP extension zip is missing from your system.

https://github.com/EdgedesignCZ/phpqa/pull/215/checks?check_run_id=1830905569#step:5:316
- Conclusion: don't install symfony/dependency-injection v2.8.50
- enlightn/security-checker v1.4 requires symfony/console ^3.4|^4|^5

.github/workflows/php.yml

@@ -34,7 +34,7 @@ jobs:
       uses: shivammathur/setup-php@v2
       with:
         php-version: ${{ matrix.php }}
-        extensions: xsl
+        extensions: xsl, zip, json
         coverage: none
         # TODO: ? https://github.com/EdgedesignCZ/phpqa/runs/1813676801?check_suite_focus=true#step:6:28 ?
         tools: composer:v1

bin/suggested-tools.sh

@@ -44,10 +44,14 @@ show_help() {
 }
 
 get_tools () {
-    TOOLS="php-parallel-lint/php-parallel-lint php-parallel-lint/php-console-highlighter enlightn/security-checker friendsofphp/php-cs-fixer:>=2"
+    TOOLS="php-parallel-lint/php-parallel-lint php-parallel-lint/php-console-highlighter friendsofphp/php-cs-fixer:>=2"
     if [[ ${PHP_VERSION:0:1} != "5" ]]; then
         TOOLS="${TOOLS} vimeo/psalm:>=2 phpstan/phpstan nette/neon"
     fi
+    if [[ $UPDATE_COMPOSER == "yes" ]]; then
+        # security-checker does not support symfony2, so it cannot be installed on default composer.lock
+        TOOLS="${TOOLS} enlightn/security-checker"
+    fi
     echo $TOOLS
 }