On doctrine/website, which is a regular Symfony application, we put the
composer.lock under version control, as we should.
In order to be able to have the same experience in the CI as we have
locally, we should use the same version of the dependencies.
To that end, let's allow passing the dependency-versions option to
ramsey/composer-install on workflows that are reused on
doctrine/website.

Allow locking the deps

Sudden upgrades can lead to broken builds. For instance, the latest
versions require us to install phpDocumentor/filesystem. Let us do the
upgrades in a controlled way from time to time instead.

fix: pin phpDocumentor