php-composer: Update to 2.2.17

Upstream release notes:

2.2.17
PSA: If you are seeing issues running non-interactive create-project with a
project that does not configure allow-plugins, see the top post of #10928 for
a workaround.
- Fixed plugins from CWD/vendor being loaded in some cases like create-project
  or validate even though the target directory is outside of CWD (#10935)
- Fixed support for legacy (Composer 1.x, e.g. hirak/prestissimo) plugins which
  will not warn/error anymore if not in allow-plugins, as they are anyway not
  loaded (#10928)
- Fixed pre-install check for allowed plugins not taking --no-plugins into
  account (#10925)
- Fixed support for disable_functions containing disk_free_space (#10936)
- Fixed RootPackageRepository usages to always clone the root package to avoid
  interoperability issues with plugins (#10940)

2.2.16
- Fixed non-interactive behavior of allow-plugins to throw instead of continue
  with a warning to avoid broken installs (#10920)
- Fixed allow-plugins BC mode to ensure old lock files created pre-2.2 can be
  installed with only a warning but plugins fully loaded (#10920)
- Fixed deprecation notice (#10921)

2.2.15
- Fixed support for cache-read-only where the filesystem is not writable
  (#10906)
- Fixed type error when using allow-plugins: true (#10909)
- Fixed @putenv scripts receiving arguments passed to the command (#10846)
- Fixed support for spaces in paths with binary proxies on Windows (#10836)
- Fixed type error in GitDownloader if branches cannot be listed (#10888)
- Fixed RootPackageInterface issue on PHP 5.3.3 (#10895)


(tpaul)