bump league/commonmark

[dmaicher]

With latest composer otherwise we get

$ composer up
Loading composer repositories with package information
Restricting packages listed in "symfony/symfony" to "6.4.*"
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires league/commonmark ^1.5, found league/commonmark[1.5.0, ..., 1.6.7] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-rqc2-tcc6-nc79", "PKSA-fndg-qryc-dyc9") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

due to security issues