satis tries to write to vendor when creating archives

i've installed satis with composer, and therefore /bin/satis, /vendor/ are readonly.

but satis seems to need that dir writable for operation when creating archives:

```

Dumping 'example/project'.
- Installing example/project (0.14.2): Downloading https://gitlab.example.net/api/v4/projects/example%2Fproject/repository/archive.zip?sha=ad841d207fdd310e1cf5956887bde19b073c
5678
Downloading (100%)Writing /app/var/cache/composer/files/example/project/be550bf3db6920647a810a52364747aa28d243f8.zip into cache from /tmp/composer_archive5b926e308f6e6/e081b3085
fa3914a25d5d162bbccf1f1.zip

Extracting archive Failed to download example/project from dist: /app/vendor/composer/57d9f2fd does not exist and could not be created.
Now trying to download from source
- Installing example/project (0.14.2): Executing command (CWD): git --version

Cloning to cache at '/app/var/cache/composer/vcs/git-gitlab.example.net-example-project.git/'
Executing command (CWD): git clone --mirror 'git@gitlab.example.net:example/project.git' '/app/var/cache/composer/vcs/git-gitlab.example.net-example-project.git/'
git@gitlab.example.net's password:
```

```
[http@38df93fc3780 app]$ ls -ld /app/vendor/composer/
drwxr-xr-x 9 root root 4096 Sep 7 11:45 /app/vendor/composer/
```

```
[root@38df93fc3780 app]# chmod a+rwx /app/vendor/composer/
[http@38df93fc3780 app]$ php -dmemory_limit=-1 /app/bin/satis build config/satis.json public/ -vvv
...

- Installing example/project (0.14.2): Reading /app/var/cache/composer/files/example/project/be550bf3db6920647a810a52364747aa28d243f8.zip from cache
Loading from cache
Extracting archive
Executing command (CWD): unzip -qq '/tmp/composer_archive5b92701e9e4f3/3719ac648055c21a987223f76c35a05e.zip' -d '/app/vendor/composer/0b9e11f4'
...
```

```
[http@38df93fc3780 app]$ composer show|grep composer
composer/ca-bundle 1.1.2 Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.
composer/composer 1.7.2 Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere.
composer/satis 1.0.0 Simple Repository Generator
composer/semver 1.4.2 Semver library that offers utilities, version constraint parsing and validation.
composer/spdx-licenses 1.4.0 SPDX licenses list and validation library.
composer/xdebug-handler 1.3.0 Restarts a process without xdebug.
````