[composer] manage project dependencies

[regisoc]

Brief summary of changes

• Allow additional composer deps to be managed in project/ without the need to override the main composer.json.
• Adds the documentation section to cover how to override LORIS.

Testing instructions (if applicable)

1. create a project/composer.json with additional deps.
2. run composer update

Related PR

Reopening #8319 as a new dependency is needed in HBCD.

[ridz1208]

@regisoc I'm seeing a bunch of unrelated changes for ID alphabet? were those meant to be in the same PR?

[regisoc]

@ridz1208 not at first no. I wanted to add the composer.json/.lock + doc change for one unique dependency.
When pushing the new composer.lock, it must have added updated requirements, with PHPStan 2, because looking into it, some of the changes are related to phpstan v2.
Several errors started to pop up on github checks, and I could not validate the PR.

Here is the list I can see:

• phpstan v2 deprecated rule excludes_analyse in favour of excludePaths.
• phpstan v2 also added a stricter rule level system, we were using the --level max but this hits the mixed type hard. Mentioned here, I lowered it to level 8 for now but I can try to put it back to 9 or 10 (max). Not sure what is the best here.
• PHPStan v2 did not like implicit parameter types in Candidate/FeedbackMRI/issue_tracker classes, null added as explicit type for all.
• Because the type returned in SideIDGenerator::_getIDSetting() was a mixed type (i.e. "array<int,int|string>|string|null") and phpstan v2 did not like that, I extracted the "alphabet" option to its own method SideIDGenerator::_getIDSettingAlphabet() to isolate returned types. They are private methods.
  • SideIDGenerator::_getIDSetting() returns string|null.
  • SideIDGenerator::_getIDSettingAlphabet() returns array<int,int|string>.

[regisoc]

@driusan pinging you here because not sure of the solution and what it would involve.

[regisoc]

Closed for #9496