Encountered a similar issue with this file as well tonight. Was able to update with composer but it would somehow not let me commit the update of that file to our project repo.
Looking into it, it appeared my system wasn't actually recognizing it as a YAML file despite having a .yml ending. Figured out there is somehow an invisible character at the end of the file name that's causing problems. Not sure how or why it's there, but you can see the extra space in the original post when it's listing the file.
ZipArchive::extractTo(D:\Git\asn9.sk/vendor/composer/faa30b5c/flood_control\migrations\state/flood_control.migrate_drupal.yml ): Failed to open stream: Permission denied
In your case, the update likely sees the existing file but doesn't think they're different because of the invisible character. Meanwhile your system interprets them as different because of the space. Which probably caused the error.
Manually removing the extra space in the name isn't quite enough to fix this because your system will usually throw similar errors because they appear as different files in the same place but with the same exact name.
Fixed it on my end by changing the filename to a different name entirely first then changing it to the original filename without the extra space.
Been dealing with the issue @mbhadr mentioned tonight after updating our PHP to 8.1.
After messing around with it for awhile, it looks like the way I got it to work is by directly including the core file which defines SAVED_UPDATES, which is "core/includes/common.inc". The only reason I had to is because the code later saves a change to an entity (in this case it changes a user's roles). If I didn't do this then it wasn't required.
Also seems like I no longer need the patch from before to make Request work. Not sure if it's because of PHP 8.1, the request_stack push, or both. But either way that's nice. It's better than having to apply a patch every time I update Drupal core.
If anyone needs it, here's what I did:
use Drupal\Core\DrupalKernel;
use Symfony\Component\HttpFoundation\Request;
$autoloader = require_once '../autoload.php';
$request = Request::createFromGlobals();
$kernel = DrupalKernel::createFromRequest($request, $autoloader, 'prod')->boot();
$requestStack = Drupal::service('request_stack')->push($request);
NOTE: autoload.php needs to be from Drupal root dir, so point to the correct path. In my case it was just in the parent folder.