Refresh abandoned state from the repositories in audit

The abandoned flag in composer.lock and installed.json is only written
when a package gets updated, so composer audit never reported packages
that were abandoned after that.

The audit command now loads the audited versions from the repositories,
first repository with the package name wins, and syncs the abandoned
state and replacement from there. This is skipped with
--abandoned=ignore and unreachable repositories are skipped with
--ignore-unreachable like for advisories.

tests/Composer/Test/Command/AuditCommandTest.php

@@ -146,6 +146,27 @@ class AuditCommandTest extends TestCase
         self::assertSame(Auditor::STATUS_OK, $exitCode);
     }
 
+    public function testAuditReportsPackageAbandonedAfterItWasLocked(): void
+    {
+        $this->initTempComposer([
+            'repositories' => [
+                'packages' => [
+                    'type' => 'package',
+                    'package' => [
+                        ['name' => 'vendor/abandoned', 'version' => '1.0.0', 'abandoned' => 'vendor/replacement'],
+                    ],
+                ],
+            ],
+        ]);
+        $this->createComposerLockWithPackages([['name' => 'vendor/abandoned', 'version' => '1.0.0']]);
+
+        $appTester = $this->getApplicationTester();
+        $exitCode = $appTester->run(['command' => 'audit', '--format' => 'plain']);
+
+        self::assertStringContainsString('vendor/abandoned is abandoned. Use vendor/replacement instead.', $appTester->getDisplay(true));
+        self::assertSame(Auditor::STATUS_FAILED, $exitCode);
+    }
+
     /**
      * @param list<array{name: string, version: string}> $packages
      */