Port the Composer transport-options drop to depscan's composer-lock-members.ts #1052

PR #1026 makes the hosted Composer rewrite (formats/composer/source.rs::apply_dist_edit) drop each redirected entry's transport-options along with source (B02 / #399). Composer applies a repository's transport-options (auth headers, client certificates, proxy) to that entry's dist download, so keeping them sends the private registry's credentials to the patch host. The rewrite warns with the new code redirect_composer_transport_options_removed.

depscan's TypeScript twin, workspaces/app/src/patches/registry-rewrite/composer-lock-members.ts, still drops only source. The new shared golden case crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/transport-options/ will fail in depscan until the twin is ported. depscan has issues disabled, so the port is tracked here.

To do in depscan:

• drop every member of the origin-bound key list (source, transport-options), rescanning between removals so adjacent members leave no dangling comma;
• widen the recorded edit to cover every changed byte, so the fragment revert restores both members;
• emit redirect_composer_transport_options_removed;
• sync the composer-lock/transport-options fixture.

🤖 Generated with Claude Code