Seems to fix it locally -
Dockerfile:

FROM docker-registry.wikimedia.org/releng/composer-php72:0.2.1-s1

USER root
RUN apt-get update && \
  apt-get install --yes \
  curl

Test:

$ docker run --rm -ti --entrypoint /bin/bash test235221
root@9a5219a953d9:/# which curl
/usr/bin/curl

So maybe curl just needs to be explicitly installed within php72 or composer-php72?

Probably a side effect of T234623, due to the new image not having curl installed.

Change 543169 had a related patch set uploaded (by SBassett; owner: SBassett):
[integration/config@master] Disable email reporting to security admin feed

https://gerrit.wikimedia.org/r/543169

Change 543169 merged by jenkins-bot:
[integration/config@master] Disable email reporting to security admin feed

https://gerrit.wikimedia.org/r/543169

This is also blocking T236589 during the npm run docs command.
The error can be seen here: https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/MobileFrontend/+/550516/

The security check job relies on a container having the entry point:

#!/usr/bin/env bash

umask 002

set -euxo pipefail

cd /src

# If there's no lock file, then generate one
if [ ! -f "composer.lock" ]; then
    composer install --no-progress --prefer-dist
fi

curl -i -H "Accept: text/plain" https://php-security-checker.wmflabs.org/check_lock -F lock=@composer.lock -o results.check
cat results.check && grep -iF "X-Alerts: 0" results.check

Originally that got introduced in the container releng/composer-php70 which has:

COPY security-check.sh /srv/composer/security-check

RUN {{ "jq curl" | apt_install }}

For the php 7.2 migration, we went creating a container releng/composer-php72 which only copy the entry point script but miss the additional packages:

FROM {{ "composer-php70" | image_tag }} as composer
...
COPY --from=composer /srv/composer /srv/composer

RUN {{ "jq" | apt_install }}

And thus we are missing curl :D

Fun thing releng/composer-php70 had curl explicitly added with ebe0aec56614d61797a599d4825ecf9803c1a7b1

Change 553102 had a related patch set uploaded (by Hashar; owner: Hashar):
[integration/config@master] docker: add curl for composer-security-check

https://gerrit.wikimedia.org/r/553102

Change 553103 had a related patch set uploaded (by Hashar; owner: Hashar):
[integration/config@master] Fix php-composer-security-docker missing curl

https://gerrit.wikimedia.org/r/553103

Thanks, @hashar. Should we file a separate bug for mwext-node10-rundoc-docker? Which is also failing for this same reason, per T235221#5690746 above.

Change 553102 merged by jenkins-bot:
[integration/config@master] docker: add curl for composer-security-check

https://gerrit.wikimedia.org/r/553102

Mentioned in SAL (#wikimedia-releng) [2019-11-26T15:50:51Z] <James_F> Docker: Pushing composer-php72:0.2.2 and composer-php73:0.1.7 for T235221

Change 553103 merged by jenkins-bot:
[integration/config@master] Fix php-composer-security-docker missing curl

https://gerrit.wikimedia.org/r/553103

The job is now working; do you want the notifications re-instated?

In T235221#5693792, @sbassett wrote:

Thanks, @hashar. Should we file a separate bug for mwext-node10-rundoc-docker? Which is also failing for this same reason, per T235221#5690746 above.

Yes please, that's nothing to do with this (and I'm not fully convinced it's a good idea).

In T235221#5693895, @Jdforrester-WMF wrote:

The job is now working; do you want the notifications re-instated?

Sure, I can probably do that.

Yes please, that's nothing to do with this (and I'm not fully convinced it's a good idea).

Filed: T239246. I guess more discussion needs to happen on this topic.

Also, with the revert now merged, I think this task can probably be resolved.