Clear cached file marked as malware

Composer should clear cached dist files when they are flagged as malware and removed from the resolver pool for installation.

Considerations against this behavior:

• If the malware is cached, it's already on your system and was likely executed. Removing it from the cache may make forensics harder.

Considerations in favor:

• If the cache is shared, deleting the file may protect other users (CI workflows or so) from getting infected.
• Removal from disk mitigates any risk the local presence of the malware still poses.