Ensure Composer dependency test/example code is safe

[asmecher]

Composer dependencies often come with test/example code. OJS/OMP/OPS place these within the web root, meaning these extras are web-accessible. They are also wasteful, but also potentially dangerous, as any .php scripts can be remotely invoked.

Unfortunately the Composer team is resistant to including tools to remove these (composer/composer#4438 and composer/composer#1750).

For .tar.gz packages, the build script includes a list of exclusions (https://github.com/pkp/ojs/blob/main/tools/buildpkg.sh). Review this and ensure it's up to date.

For git-based installations, we unfortunately can't exclude parts of dependencies without support in Composer, but we can ship a .htaccess file to restrict remote access to them.

It appears to be generally (but not officially) recommended that vendor be kept outside the web root; see #1832 for discussion/work that would achieve this.