Bake version data into PHAR file

Compatibility between `ocramius/package-versions`,
`composer/package-versions-deprecated`, `composer-runtime-api` and
`humbug/box` (with `humbug/scoper` further complicating things)has been
always a problematic area. So instead of trying to keep up with all the
changes in all of those packages, we will now bake the version data (for
the packages we need) into the PHAR file itself.

Fixes #7606
Fixes #5399

bin/build-phar.sh

@@ -8,6 +8,12 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
 php $DIR/improve_class_alias.php
 
+php -r 'require "vendor/autoload.php"; Psalm\Internal\VersionUtils::dump();'
+if [[ ! -f build/phar-versions.php ]] ; then
+   echo "failed to dump versions";
+   exit;
+fi
+
 vendor/bin/box compile
 
 if [[ "$GPG_SIGNING" != '' ]] ; then

box.json.dist

@@ -1,7 +1,11 @@
 {
     "output" : "build/psalm.phar",
     "files": [
-        "psalm"
+        "psalm",
+        "build/phar-versions.php"
+    ],
+    "map": [
+        {"build/phar-versions.php" : "phar-versions.php"}
     ],
     "files-bin": ["config.xsd"],
     "directories-bin" : [