Support vendoring for PHP

_From @ChristophWurst on December 13, 2017 11:47_

Hi there,

I just wanted to give dependabot a test run for [Nextcloud's 3rdparty libs](https://github.com/nextcloud/3rdparty/issues/36#issuecomment-351308076) and I've encountered a problem. Instead of pulling dependencies every time, we do commit them in our git repo. However, dependabot seems to only update the `composer.json` and `composer.lock` file. The actual source files of the updated dependencies remain outdated.

Is there any way to tell dependabot to commit those changes?

Note: since it's just a test, I tried to enable it on [a fork](https://github.com/ChristophWurst/3rdparty) first to see how well it works. As you can see [here](https://github.com/ChristophWurst/3rdparty/pulls), it correctly detected outdated libs, but none of the source files were changed in those PRs.

Thanks

_Copied from original issue: dependabot/feedback#62_