Strategy for composer dependencies

[davidcoutadeur]

This issue is here to discuss the strategy for composer dependencies.

Depending on the operating system, and especially the php version, the composer dependencies won't be the same.

For example, in 2024 of July, we still propose self-service-password package on old systems like EL7. (php 7.4)

I think it is preferable to let people generate this file by themselves. This implies:

• [x] removing composer.lock
• [x] add composer.lock into .gitignore (already done in #890)
• [x] add a note in documentation to tell people to make composer update

[coudot]

My point of view is that composer is only needed for dev.

We choose to provide vendor/ in our distribution tarball and in our packages, no one needs to run composer in this case.

So removing composer.lock is ok for me. Documentation is needed only for dev.

[davidcoutadeur]

I am ok with that. I will do the modifications.

[davidcoutadeur]

Done in f586c00 + cd3826b