[TASK] Tighten composer integration validation script

The script "Build/Scripts/checkIntegrityComposer.php"
verifies composer.json dependencies of each system
extension to have the same version as the root composer.json
manifest file.

The patch adds an additional check that all dependencies
of a system extension also have a counterpart
in the main root composer.json of the development collection.

This way, we avoid scenarios where we remove a dependency from
the root composer.json and forget to remove it from system
extensions, too.

Resolves: #96757
Related: #96756
Related: #96749
Releases: main, 11.5
Change-Id: Ia179e79f5370137d37f572661570bd0fc225212e
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/73315


Tested-by: Christian Kuhn <lolli@schwarzbu.ch>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Benni Mack <benni@typo3.org>
Reviewed-by: Christian Kuhn <lolli@schwarzbu.ch>
Reviewed-by: Benni Mack <benni@typo3.org>

Build/Scripts/checkIntegrityComposer.php

@@ -130,6 +130,17 @@ class checkIntegrityComposer
                 ];
             }
         }
+        // Check root composer.json for missing non-sysext required packages
+        foreach ($extensionComposerJson['require'] ?? [] as $requireKey => $requireItem) {
+            if (!str_starts_with($requireKey, 'typo3/cms-') && !isset($this->rootComposerJson['require'][$requireKey])) {
+                $this->testResults['repo-root'][] = [
+                    'type' => 'require',
+                    'dependency' => $requireKey . ' by ' . $extensionKey,
+                    'shouldBe' => $requireItem,
+                    'actuallyIs' => 'missing',
+                ];
+            }
+        }
     }
 
     /**