refactor: #3618245 Remove vardot/varbase-patches from the site template recipe's composer.json and wire it from the script only

Issue: https://www.drupal.org/project/horizonaid/issues/3618245

What

Remove "vardot/varbase-patches": "~11.0.0" from the Horizon Aid recipe's composer.json.

Why

vardot/varbase-patches is a composer-plugin. A Composer plugin only functions from the root composer.json, where config.allow-plugins and extra.composer-patches.allowed-dependency-patches live, and a recipe cannot set either of those for the project installing it. So the recipe's own requirement never made any patch apply. It only pulled the package in and coupled Horizon Aid to a Vardot-specific plugin.

The root wiring already exists and is where this belongs: scripts/drupal-cms-wiring.php plus scripts/assets/drupal-cms.composer.json write the allow-plugins block and the default-deny patch allowlist, and then instruct composer require vardot/varbase-patches from the project root.

Also reworded one stale comment in .gitlab-ci.yml above the Drupal CMS install job, so it says the requirement now lives only in the wiring script's root instructions. No job logic changed.

Testing

The 🧩 (Drupal CMS) Install Horizon Aid site template job is the one that proves this is safe: it builds a plain drupal/cms codebase, runs the wiring script, requires vardot/varbase-patches at the root itself, then asserts the allow-plugins block, minimum-stability: dev and the allowed-dependency-patches list before installing the site template through the installer.

AI-Generated: Yes

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release