More deterministic package sorting

[Seldaek]

Fixes #10614

• Do not read require-dev except for the root package when sorting packages-
• Sort packages with the same weight alphabetically to have a completely stable sort not dependent on input order

[AlbinoDrought]

I appreciate this change - it helps our builds be more reproducible. I'm writing this comment here because I'm not sure of a more appropriate place.

We have a Laravel project that also imported cakephp/core through a dependency.

In 2.2.5, Laravel's Support/helpers.php was loaded before CakePHP's core/functions.php: (always? not sure, it was before deterministic sorting)

<?php
// [...]
return array(
    // [...]
    '265b4faa2b3a9766332744949e83bf97' => $vendorDir . '/laravel/framework/src/Illuminate/Collections/helpers.php',
    'c7a3c339e7e14b60e06a2d7fcce9476b' => $vendorDir . '/laravel/framework/src/Illuminate/Events/functions.php',
    'f0906e6318348a765ffb6eb24e0d0938' => $vendorDir . '/laravel/framework/src/Illuminate/Foundation/helpers.php',
    '58571171fd5812e6e447dce228f52f4d' => $vendorDir . '/laravel/framework/src/Illuminate/Support/helpers.php',
    '72142d7b40a3a0b14e91825290b5ad82' => $vendorDir . '/cakephp/core/functions.php',
    '948ad5488880985ff1c06721a4e447fe' => $vendorDir . '/cakephp/utility/bootstrap.php',
    // [...]
);

In 2.2.9, CakePHP's core/functions.php gets loaded before Laravel's support/helpers.php:

<?php
// [...]
return array(
    // [...]
    '72142d7b40a3a0b14e91825290b5ad82' => $vendorDir . '/cakephp/core/functions.php',
    // [...]
    '265b4faa2b3a9766332744949e83bf97' => $vendorDir . '/laravel/framework/src/Illuminate/Collections/helpers.php',
    'c7a3c339e7e14b60e06a2d7fcce9476b' => $vendorDir . '/laravel/framework/src/Illuminate/Events/functions.php',
    'f0906e6318348a765ffb6eb24e0d0938' => $vendorDir . '/laravel/framework/src/Illuminate/Foundation/helpers.php',
    '58571171fd5812e6e447dce228f52f4d' => $vendorDir . '/laravel/framework/src/Illuminate/Support/helpers.php',
);

Both files contain an env function wrapped around if (!function_exists('env'):

• Laravel
• CakePHP

As a result, after upgrading to 2.2.9, the CakePHP file consistently gets loaded first, and all calls to env are now using the CakePHP version.

We noticed this because our calls to putenv appeared to stop having an effect, and calls to env() are only returning strings. Laravel's version performs additional casting that some vendored code relied on.

Our solution was to replace the dependency that is importing cakephp/core. Additionally, to ensure this dependency doesn't reappear in the future, we conflict with it:

    "conflict": {
        "cakephp/core": "*"
    }

Cheers!