Installer needs to verify the Phar about getcomposer.org

[Seldaek]

Done

[padraic]

Basic approach:

1. Implement TLS verification for Composer.
2. Create signature for installer (GPG).
3. User verifies signature of installer (it's optional - they may not do it).
4. User runs installer.
5. Download composer.phar (openssl signed).
6. Download composer.phar.pubkey (public key).
7. Use pubkey to verify all self-updates.
8. Examine if instructions can make the installer optional.

I've written most of the pieces, inspired in part from Composer's self-update and borrowing liberally from all the work we previously did on the TLS support for the installer:
https://github.com/padraic/phar-updater
https://github.com/padraic/file_get_contents

These push all the changes to Composer into two dependencies and out of the core code which should be significantly simpler. Currently wrapping these two up for Humbug self updates. They can alternatively be ported into Composer, but...the duplication of effort on my part is preferably avoidable.

Note: The very first requests are not verifiable, i.e. you cannot verify that the GPG and openssl public keys are themselves valid. This is basically the first-encounter approach that ssh uses. You get these once, accept them, keep them permanently, and reuse them constantly, and never accept updates to them without a really really good reason.