[Composer] Prefer composer.json constraint over outdated installed.json version

[TomasVotruba]

InstalledPackageResolver read package versions only from vendor/composer/installed.json. After a branch switch, that file can be stale - it may still hold the version installed for the other branch, and composer-based sets are then picked for the wrong major version.

Now the composer.json constraint wins: when the installed version does not satisfy the required constraint, the lowest version allowed by the constraint is used instead.

Example - branch requires PHPUnit 10, but vendor/ still holds PHPUnit 11:

// composer.json
{
    "require-dev": {
        "phpunit/phpunit": "^10.5"
    }
}

// vendor/composer/installed.json
{
    "packages": [
        { "name": "phpunit/phpunit", "version_normalized": "11.5.2.0" }
    ]
}

-phpunit/phpunit: 11.5.2.0   # PHPUnit 11 sets loaded
+phpunit/phpunit: 10.5.0.0   # PHPUnit 10 sets loaded, as composer.json requires

Untouched cases:

• installed version satisfies the constraint - installed version kept, as before
• package not required in composer.json - installed version kept
• * or dev constraints - no usable lower bound, installed version kept