Permit downloading Composer packages over http

The Package Index is served over http, which we should probably change.
For the time being, we need to unfatal the fatal.

php/commands/package.php

@@ -271,9 +271,12 @@ private function package_index() {
 
 		if ( !$package_index ) {
 			$config = new Config();
-			$config->merge(array('config' => array(
-				'home' => dirname( $this->get_composer_json_path() ),
-			)));
+			$config->merge( array(
+				'config' => array(
+					'secure-http' => false,
+					'home' => dirname( $this->get_composer_json_path() ),
+				)
+			));
 			$config->setConfigSource( new JsonConfigSource( $this->get_composer_json() ) );
 
 			try {