Implicitly allow drupal/core and legacy scaffold projects to scaffold files.

Problem/Motivation

In order to maintain appropriate security, safety and "principal of least surprise," the Scaffold Plugin will only allow a dependency to provide scaffold files if it is explicitly whitelisted in the top-level composer.json. The top-level composer.json file itself is also implicitly allowed.

At the same time, we would like to keep the Composer template projects (c.f. #2982680: Add composer-ready project templates to Drupal core) simple, so that there as few moving parts as possible to give users the best odds of being successful in moving to Composer. Also in the works is a new project drupal/legacy-scaffold-assets that will provide forward-compatibility for Drupal 8.8.x Composer components with Drupal 8.7.x sites.

Proposed resolution

Since the new core-composer-scaffold component is specifically designed for use with Drupal, it seems simpler and more logical to implicitly allow the standard projects that contain scaffold files without explicit mention in the project composer.json file.

Without this change, the project templates must contain an "allowed-packages" entry in the "extra/composer-scaffold" section:

    "extra": {
        "composer-scaffold": {
            "allowed-packages": [
                "drupal/core"
            ],
            "locations": {
                "web-root": "web/"
            }
        },

With it:

    "extra": {
        "composer-scaffold": {
            "locations": {
                "web-root": "web/"
            }
        },

If a project has a distribution / installation profile or a host-compatibility project that scaffolds files or alters scaffold files, it must still be whitelisted in "allowed-packages".

Remaining tasks

None.

User interface changes

None.

API changes

None.

Data model changes

None.

Release notes snippet

The Drupal Composer Scaffold component now implicitly allows the projects drupal/core and drupal/legacy-scaffold-assets to scaffold files, even if they are not whitelisted in the top-level composer.json file.