Manage composer dependencies in RPM and Debian packaging

For RPM, I suggest the easy way: take the distribution tarball as source, which already contains vendor dependencies, remove system packaged dependencies in build.

For Debian, seems the process is to patch the composer.json/composer.lock from sources and run the composer update during build. Quite more complex than relying on the distribution tarball, any help is welcomed.