The vendor hardening plugin can be configured to skip cleaning certain packages

Previously, the drupal/core-vendor-hardening Composer plugin could be configured to clean additional packages beyond the ones it knew about by default, but could not be configured to skip cleaning particular packages.

You can now do that by setting this configuration in your project's composer.json (in this example, we're telling the plugin to not clean composer/composer):

"extra": {
  "drupal-core-vendor-hardening": {
    "composer/composer": false
  }
}

Or, at the command line:

composer config extra.drupal-core-vendor-hardening --merge --json '{"composer/composer": false}'

With this configuration, when composer/composer is installed, it will be left unchanged and all of its files will be in the vendor directory. Therefore, you should use this option with care and only if you know exactly what you're doing, as extra files in the vendor directory can pose a potential security risk in some circumstances.