Only re-require Composer packages if they aren't already installed

[rjkip]

After having run QA Tools once, subsequent runs will cause composer require calls for all package dependencies. This can cause the versions of tools to be upgraded. In my opinion, this is not expected behaviour and upgrading packages is a manual task.

[rjkip]

@DRvanR wrote:

Agreed, possible solutions:

• parse a dry-run output (not really in favor)
• A "composersystemthingymabob" tracks the currently required packages based on given answers to previous configs (could be in the TodoList or something like that when registering new ComposerDevDepTask) and allows to only install new packages (As they can be identified from not being a previously given answer) - optionally offering to upgrade packages using require.

[rjkip]

Another possible solution: change the Composer require API to only require new or changed packages/versions. This way repeated requires of phpunit/phpunit:^5 only result in one actual require request to Composer, until, for instance, the version constraint is changed to phpunit/phpunit:^6. Should be pretty easy.