[6.x] Honour the COMPOSER env var when locating composer.json and its lock file

[duncanmcclean]

This pull request fixes an issue where Statamic would error when the COMPOSER environment variable points Composer at a different composer.json file (eg. COMPOSER=composer.local.json).

This was happening because Statamic hard-coded composer.json and composer.lock paths. Composer names the lock file after the configured JSON file (composer.local.json → composer.local.lock), so Version::get() couldn't find a lock file and threw on every request, and statamic:install reported a missing pre-update-cmd hook because it was reading a composer.json that no longer existed.

This PR fixes it by resolving the filenames the same way Composer does. Json::filename() reads the COMPOSER environment variable (falling back to composer.json) and Lock::filename() derives the lock filename from it. Everywhere Statamic previously assumed composer.json or composer.lock now goes through these, including the update scripts, starter kit installer/exporter and make:addon.

Fixes #10592