ci(sansec-ecomscan): adopt cache-magento stamp cache (#251)

Adds `composer update --no-install` ahead of cache-magento so the
lock exists when the stamp key is computed, then flips on
stamp:true with the matching working-directory. This shortens
ecomscan runs from "full composer install" to "warm vendor/" on
warm hits.

.github/workflows/_internal-sansec-ecomscan.yaml

@@ -56,9 +56,14 @@ jobs:
           magento_version: ${{ matrix.magento }}
           composer_auth: ${{ secrets.COMPOSER_AUTH }}
 
+      - run: composer update --no-install
+        working-directory: ${{ steps.setup-magento.outputs.path }}
+
       - uses: ./cache-magento
         with:
           composer_cache_key: ${{ matrix.magento }}
+          working-directory: ${{ steps.setup-magento.outputs.path }}
+          stamp: true
 
       - name: Composer install
         shell: bash