fix: Stop requiring composer itself

[xolf]

Requiring composer itself might lead to a difference between the project composer version and the locally installed version. By this no composer actions can be performed any more in case of breaking changes.

See composer/composer#11940

🚥 Resolves ISSUE_ID
#987

🧰 Changes

The readme/metrics requires Composer itself. As mentioned by the maintainers of Composer, see composer/composer#11940 (comment), this is a bad design and lead to unusable composer installation if the version within the vendor folder differs from the system-wide installation.

I'm not quite sure, what are the reasons to require composer/composer itself, but not other package are requiring composer, so one should be safe to remove.

🧬 QA & Testing

Provide as much information as you can on how to test what you've done.

[Seldaek]

Checking again for Composer usage in this repo now that I'm on a computer.. it seems Composer\Factory is used here

metrics-sdks/packages/php/src/Metrics.php

Line 260 in d97b3d0

$this->cache_dir = Factory::createConfig()->get('cache-dir');

So this PR will break that, and it should be adjusted/removed.

In a way I kinda see the use case of reusing Composer's cache dir, although I also kinda disagree that other software should dump stuff in there. But I mainly disagree that it's a good idea to pull the entire composer codebase and dependencies into the project just to read a cache-dir value out of the composer.json file. That seems really overkill.

Unfortunately I'm not sure there is a sensible way to expose only Composer\Config in a standalone package as it depends on quite a few other things, the entire composer core is intertwined in many ways that make it hard to extract only some bits of it.

[erunion]

Yeah we (un)fortunately use the cache_dir that Composer uses for caching data about your project so we don't have to make that API call for every call we make to our Metrics service. It's been a while since I've worked on this SDK, and used Composer, but if there's another way to access that cache directory without having to use a Composer API for it I'd love to move to that as I agree, and have never liked requiring a direct dependency on Composer for that.

[Seldaek]

Yeah i mean you can read composer.json but if that doesn't set a cache-dir you have to figure out the composer home dir then cache dir, which would mean copying some amount of code from Composer\Factory i guess. I'm not sure what's worse..