fix(composer): consume icewind deps from GitHub mirrors to survive Codeberg outages [10.16]

[oc-tmueller]

Backport of #41707 to 10.16.

Problem

CI on 10.16 fails whenever codeberg.org is unhealthy. Neither icewind/streams nor icewind/smb publishes a dist archive on Packagist, so Composer must git-clone them from Codeberg — and Codeberg regularly returns 503/504.

Example: run 34099036638 on #41815 — the Install Composer dependencies step died with:

Failed to execute git clone --mirror -- https://codeberg.org/icewind/SMB ...
fatal: unable to access 'https://codeberg.org/icewind/SMB/': The requested URL returned error: 504

This is unrelated to the PR under test — any job on 10.16 that installs Composer dependencies can hit it.

Fix

Add VCS repositories entries pointing at the GitHub mirrors, identical to master:

"repositories": [
    { "type": "vcs", "url": "https://github.com/DeepDiver1975/streams" },
    { "type": "vcs", "url": "https://github.com/DeepDiver1975/SMB" }
]

GitHub serves a dist zipball via its API, so Composer downloads a zip and never touches Codeberg at install time.

How this backport differs from master

Master locks icewind/smb 3.8.1, which requires php >= 8.2. This branch pins platform.php to 7.4, so the master lock hunk is not portable and 10.16 stays on v3.7.0.

Both packages are re-locked at the exact refs already in the lock — smb e6904cb, streams cb2bd3e — which the mirrors carry at the same tags. So this is a pure source repoint: no version bump, no dependency-tree change. Only source.url changes, plus the dist block and the metadata Composer takes from the VCS driver rather than Packagist. Constraints in require are untouched.

Verification

Ran under owncloudci/php:7.4 (matching the branch platform) with codeberg.org blackholed to 127.0.0.1, so any attempt to reach it fails hard:

• Before (unpatched 10.16): composer install fails — Failed to execute git clone --mirror -- https://codeberg.org/icewind/streams ... Connection refused. Reproduces CI exactly.
• After (this branch): composer validate reports the lock in sync, and composer install --no-dev completes with exit code 0. Both icewind/smb and icewind/streams install from the GitHub zipballs; the installed icewind/smb declares php: >=7.2, confirming v3.7.0.
• grep codeberg composer.lock → 0 matches.

🤖 Generated with Claude Code

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.