CompositeConfiguration merges into the root node of the first configuration instead of using its own root-node

Log4j 2.24..3
----
The composite configuration uses the root-node of the first configuration in the provided list as the basis for the merge of all configurations.

```
rootNode = configurations.get(0).getRootNode();
...
for (final AbstractConfiguration config : configurations) {
mergeStrategy.mergeRootProperties(rootNode, config);
}
```

As @ppkarwasz mentioned in the comments of (#3173) this is an error because it changes the original source configuration instead of populating the composite.

The fix would be to use the composite configuration's rootNode (protected access via 'AbstractConfiguration'). The rootNode is created empty by the super-constructor.

```
for (final AbstractConfiguration config : configurations) {
mergeStrategy.mergeRootProperties(rootNode, config);
}
```