composer writes "allow-plugins" to composer.json