Drupal core-recommended pins vulnerable twig/twig version

Problem/Motivation

Twig once again has security vulnerabilities and Drupal pins the vulnerable versions, preventing composer from installing or updating Drupal.

Problem 1
- Root composer.json requires drupal/core-recommended ^11.3.10 -> satisfiable by drupal/core-recommended[11.3.10].
- drupal/core-recommended 11.3.10 requires twig/twig ~v3.26.0 -> found twig/twig[v3.26.0] but these were not loaded, because they are affected by security advisories ("PKSA-fbvq-z33h-r2np", "PKSA-g9zw-qxh8-pq8w", "PKSA-yd6k-t2gh-1m43", "PKSA-1tmc-rt7x-12w6", "PKSA-xx6c-6d96-db2w"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

Steps to reproduce

1. Install Drupal core using drupal/core-recommended 11.3.10.
2. Run: composer audit
3. Observe the vulnerabilities reported for twig/twig.
4. Run: composer update twig/twig -W
5. Observe that Composer cannot resolve dependencies because the vulnerable version is pinned by drupal/core-recommended.

Proposed resolution

Update the pinned twig/twig version in
drupal/core-recommended to a non-vulnerable release: v3.27.0

Also, we should consider what to do if this keeps happening more frequently. With AI being used more and more to find vulnerabilities, it's likely that the frequency of vulnerability fixes will increase.

Workaround

composer require "twig/twig": "v3.27.0 as v3.26.0"