Issue #3133903 by longwave, jungle: Ensure all packages in composer.lock are considered for vendor hardening