Add PHP (composer) support

[flavioheleno]

This PR adds support for PHP checking based on Composer dependency manager.

The dependencies are checked against Composer's official package repository Packagist.

Please note that the way composer handles dependencies is quite different from pip and npm, the developer can define[1]:

1. Different source repositories for a package
2. Different package repository without disabling Packagist
3. Different package repository disabling Packagist

The current implementation does not check for those configuration changes.

There is also a very thorough blog post[2] that explains why PHP/Composer is not susceptive to this attack.

[1] https://getcomposer.org/doc/05-repositories.md
[2] https://blog.packagist.com/preventing-dependency-hijacking/

[joohoi]

This looks great, thanks, merging it in!