Use --no-audit for package manager composer runtime operations

Problem/Motivation

Follow-up from #3491268: Look into skipping audit of composer operations in package manager tests. Per the discussion in that issue, audit was not disabled originally due to a misunderstanding that it functioned like composer validate, package manager doesn't do anything with the results of composer audit or handle errors from it, so we shouldn't be calling it.

#3531138: Consider showing composer audit results in a report is open in case we want to expose composer audit to a UI, but then it still shouldn't run on every single composer command that package_manager runs.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet