Packagist service improvements

[chris48s]

📋 Description

Refs #7782 (comment)

At the moment we are validating the response before applying the decompression. This means we have to accept missing values and __unset in the validation. A better approach would be to do something like I suggested in #6508 (comment) - decompress the response first then validate it. This would have two advantages:

• It would allow us to clean up the schemas/validation - we can .require() the things that are required
• It would make it easier to "fall into the pit of success" when working on this code. At the moment if we add a new packagist badge it is really non-obvious that we need to call expandPackageVersions() on the response and if the latest release is stable you probably won't notice anything off. This should be handled transparently in the base class (both for fetch() and fetchDev()).

There may also be some test cases that need updating for this

Additionally at the moment there is a single BasePackagistService class for both the v2 API and the cached API but really these are two different APIs. If we're going to go down the route of overriding _requestJson we'll need to split this into two base classes as the cached API doesn't return compressed responses, but maybe this would be clearer what is going on to split into two base classes anyway.