Require PHP-TUF's Composer integration plugin

Problem/Motivation

In #3316617: Add a validator to check that PHP-TUF's Composer integration is present and configured correctly we are adding a validator that ensures PHP-TUF support is present in the site's Composer configuration. However, the validator is not actually tagged as an event subscriber, so it's dormant code.

Several things have to happen for TUF to be activated on a Drupal site (most need child issues):

• The PHP-TUF Composer plugin needs to be present and installed as a dependency. (This likely necessitates tagging stable releases of both the plugin and the underlying PHP-TUF library.)
• The plugin also has to be listed in Composer's allow-plugins config. That's being done for new sites by #3522991: The project templates should allow the PHP-TUF plugin, but existing sites will need to either run a Composer command, or we'll need to write an update or install hook that modifies the project-level composer.json.
• The packages.drupal.org repository has to be explicitly opted into TUF. That's also done in composer.json and will either need to be set for new sites right off the bat, or we'll need an update/install hook to do it.
• Some recent root metadata for drupal.org's TUF repository has to be in PROJECT_ROOT/tuf/packages.drupal.org.json. We'll need to ship this for new and existing projects -- a scaffold file is probably the correct approach. This is most likely best done when we're nearing a stable release of Package Manager in core.
• Core needs to mark the PHP-TUF validator in Package Manager as active (i.e., tag it as an event subscriber).

Proposed resolution

Tag the validator as an event subscriber, and add a hard dependency on php-tuf/composer-integration to Package Manager.

Remaining tasks

Postponed on:

1. https://github.com/php-tuf/php-tuf/issues/385 which should be resolved by https://github.com/php-tuf/php-tuf/pull/387 and https://github.com/php-tuf/php-tuf/pull/386
2. #3370270: [PP-1] Add php-tuf/composer-integration to core dependencies
3. #3316617: Add a validator to check that PHP-TUF's Composer integration is present and configured correctly
4. drupal.org deploying TUF support to packages.drupal.org in #3325040: [Packaging Pipeline] Securely sign packages hosted on Drupal.org using the TUF framework and Rugged