Blocking malware downloads for every Composer version in Private Packagist

Private Packagist now refuses to serve distribution files for malware-flagged versions regardless of the Composer client version, returning HTTP 410 with an explanation when malware is detected. This blocks downloads even on older Composer clients that lack built-in malware protections, building on the dependency policy framework introduced in Composer 2.10. Combined with fallback path closures, this creates a unified defense preventing silently corrupted dependencies from reaching developers across any Composer version.