Replace ComposerLockDiff functionality with a sticky PR comment instead

[justafish]

Trying to preserve the original content of a comment is causing too many bugs, and doesn't work well when there are edit conflicts

• Use a sticky pull request comment instead of a section in the PR body.
• Configure the action to only run in composer.lock is modified: https://stackoverflow.com/a/63822945

[davereid]

Related: #317

[davereid]

My proposal (with approval already from @justafish) is to replace updating the PR body with a sticky comment using https://github.com/marocchino/sticky-pull-request-comment.

[mrdavidburns]

@YesCT and I were just talking about this yesterday. We've had multiple projects where we successfully switched to posting to a comment to avoid this issue. +1 for switching Drainpipe posting to comment.

[davereid]

Also would be looking to remove DDEV as a dependency of this task to help speed up the job (would also fix #239) and just use composer natively like we did on another client independent of Drainpipe which seemed to work really well and be fast.

[deviantintegral]

I updated this to also add a one-line change to only run the action at all if composer.lock is modified.

[davereid]

I think it would still need to run on push because it's possible for a PR to have a composer.lock change initially, but then not have one after merging in updates, so it would still need to delete the comment in that case. But running the diff could be conditional on changes in that file.

[justafish]

here's an alternative solution that combines it with the security checks - 2 birds with 1 stone!
#636