Support composer packages not registered on Packagist

[stof]

Since #109, we are validating the composer reference for mistakes, by checking the package against packagist. This makes it impossible to register a package available on custom composer repositories (see #126 for typo3 extensions, but it could also affect other communities which only start their migration to a composer ecosystem and keep things outside Packagist).

I suggest to add an optional composer-repository setting in the advisory, which would allow to validate the package against a different repository (omitting it would validate against Packagist). What do you think ?

[xabbuh]

👍 sounds like a good idea

[fabpot]

👍

[Deleted user]

Any news here? My pull request #126 depends (will depend) on this feature.