Allow to set the URL for the security advisories composer url via env variable

[Cyberschorsch]

The URL which is used in the drush pm:security command is hard-coded and links to the drupal-security-advisories repo ( https://github.com/drupal-composer/drupal-security-advisories ). I really would like to have an easy option to use a different url if needed.

This PR sets the url for the source of the security check command to the environment variable DRUSH_SECURITY_ADVISORIES_URL if set, otherwise use the default url.

[weitzman]

Seems reasonable.

• Please add a comment about this env variable not being a supported API.
• Pkease use the null coalesce php operator to save some characters,

[Cyberschorsch]

@weitzman thank your for the fast feedback, really appreciate it. I made the changes you suggested.

[weitzman]

I see that the tests are failing. Hopefully its a quick fix.

[Cyberschorsch]

Since getenv() returns FALSE instead of NULL if the env variable is not set or empty we propably have to stick with the ternary operator.

[weitzman]

yeah, i was thinking of ternary. here is a suggested change