Add check to Vendor directory outside of Webroot.

Problem/Motivation

In this Drupal application, the Composer vendor directory may be located inside the publicly accessible webroot, which can expose library source code and tooling to direct HTTP access and increase the risk of information disclosure or exploitation.

Steps to reproduce

Proposed resolution

Add a new Security FitCheck plugin VendorDirectoryOutsideWebrootCheck that:

• Determines the webroot path and the current location of the vendor directory for the Drupal installation.
• Fails with FitWeight::High if vendor is inside the webroot (or otherwise directly web-accessible), and passes with FitWeight::Ok when it is outside or properly protected.
• Outputs a short help message recommending moving vendor outside the webroot or blocking HTTP access to it at the server level.

Remaining tasks

User interface changes

API changes

Data model changes