eventually there will be some component used by more than one extension. these dependencies should be managed centrally for wmf's mediawiki installation instead of putting everything into our own build.
https://github.com/wikimedia/composer-merge-plugin
https://github.com/wikimedia/mediawiki-vendor
this means still having WikidataBuildResources but not run composer install in it and maybe rename / have it be the "Wikidata" extension that we deploy.
https://github.com/wikimedia/mediawiki-extensions-Wikidata
the one problem with this is that we have some dependencies that are installed as extensions, in "$IP/extensions/...". It is weird and probably problematic to do that with composer, side-by-side with the other extensions that are handled as submodules. I am not sure where would put them instead or how we would handle this.