Documented the security:check command

| Q             | A
| ------------- | ---
| Doc fix?      | no
| New docs?     | yes
| Applies to    | all
| Fixed tickets | #4051
"odds are" sounds like it's likely. Is it likely? Or can we soften the wording.

And I think it would be nice to actually say Composer or `composer.json` here to be absolutely clear what "dependencies" we're talking about.