Composer vulnerability leaks GitHub Actions GITHUB_TOKEN in logs due to format mismatch

Summary

A security vulnerability has been identified where Composer leaks the full contents of GitHub OAuth tokens (specifically GITHUB_TOKEN) to stderr logs when the tokens don't match Composer's expected format. GitHub introduced a new GITHUB_TOKEN format that includes a hyphen, which fails Composer's validation and causes the token to be disclosed in logs. This issue is amplified because many widely-used GitHub Actions (like shivammathur/setup-php) automatically register GITHUB_TOKEN into Composer's global auth.json, meaning the leak can trigger without any unusual user configuration.