Issue #2375997 by Mile23, hussainweb, tstoeckler, omers: Avoid tying Drupal 8's composer.json to specific package commits