minor #3726 Use Box 3 to build the PHAR (theofidry, keradus)

This PR was merged into the 2.12 branch.

Discussion
----------

Use Box 3 to build the PHAR

This PR is a suggestion to switch from the unmaintained Box 2 to the Humbug fork in which the version 3 is being developed.

A few things worth mentioning:

- I used a `Makefile` instead of a bash file as I think it's an improvement for this kind of task, there is a better discoverability (type `make` and you could get the list of the commands) and it's easier to manage the task dependencies, i.e. get that `make smth` and it just works experience, no need to figure out how to install Box, do a `composer install` or something.
- I used [`bamarni/composer-bin-plugin`](https://github.com/bamarni/composer-bin-plugin) to install Box as a dependencies without polluting the library dependencies. I can switch that to a PHAR if you prefer, but in any case I think it's better to have a way which does not require contributors to figure out which tool they need to install and better not require them a tool globally on their machine. If you are interested in more on the topic, I wrote an [entire article](https://medium.com/@tfidry/managing-your-dependencies-in-php-321d584441ab) about it

I also noticed the `composer.lock` is not committed. IMO it should: it sure does not make any difference to the user when consuming the project as a library, but when you are shipping a PHAR you are shipping a real application on which it's better to have control on what dependencies is used there.

On the same token, I didn't find any e2e tests for the PHAR. I would _highly_ recommend to have one. Updating all the deps, adding some on the fly and shipping all the stuff in the PHAR and wish that it just works is being a bit insouciant. The PHAR transformation is not a trivial process although Box try very hard to make it easier, there is still code that just don't work within the PHAR.

I've pushed that against 2.x as it's still the default branch, but it can be easily ported to 3.x as well

Commits
-------

b25d20b Update Box 3 integration
86f03cd Upgrade to Box 3

Author: keradus

.gitignore

@@ -1,4 +1,6 @@
 /.php_cs
+/box.json
 /composer.lock
+/php-cs-fixer.phar
 /phpunit.xml
 /vendor/

box.json

@@ -0,0 +1,34 @@
+{
+    "check-requirements": false,
+    "dump-autoload": false,
+    "stub": "php-cs-fixer",
+    "compactors": [
+        "KevinGH\\Box\\Compactor\\Json",
+        "KevinGH\\Box\\Compactor\\Php"
+    ],
+    "files": [
+        "dev-tools/ci-integration.sh",
+        "LICENSE"
+    ],
+    "finder": [
+        {
+            "name": [
+                "*.php"
+            ],
+            "exclude": [
+                "Test",
+                "test",
+                "Tests",
+                "tests"
+            ],
+            "in": [
+                "src",
+                "vendor"
+            ]
+        }
+    ],
+    "blacklist": [
+        "psalm-autoload.php"
+    ],
+    "git-commit": "git-commit"
+}

box.json.dist

@@ -8,14 +8,14 @@ composer config platform.php 2> /dev/null || composer config platform.php 5.6.0
 composer require --no-update symfony/polyfill-mbstring
 
 # install package deps without dev-deps / remove already installed dev-deps
+# box can ignore dev-deps, but dev-deps, when installed, may lower version of prod-deps
 composer update --no-interaction --no-progress --no-dev --prefer-stable
 composer info -D | sort
 
-# install box2 globally
-composer global show kherge/box -q || composer global require --no-interaction --no-progress kherge/box:^2.7
+composer show -d dev-tools humbug/box -q || composer update -d dev-tools --no-interaction --no-progress
 
 # build phar file
-php -d phar.readonly=false "$(composer config home)/vendor/bin/box" build
+dev-tools/vendor/bin/box compile
 
 # revert changes to composer
 git checkout composer.json

dev-tools/build.sh

@@ -3,6 +3,7 @@
         "php": "^7.1"
     },
     "require-dev": {
+        "humbug/box": "~3.7.0",
         "localheinz/composer-normalize": "^1.1",
         "maglnet/composer-require-checker": "^2.0",
         "mi-schi/phpmd-extension": "^4.3",