Problem: Easily allow 'vendor' directory not under the webroot

This is currently possible, but requires some patches and a build process.

Here's the patches and process currently used by myDropWizard for Roundearth.io:

Patches:

1. Find CKEditor relative to the resource URL: https://github.com/mydropwizard/civicrm-core/commit/9fc3877e2eb14e2829b530445c5e5491afc4bbe
2. Look for vendor directory above web root: https://github.com/mydropwizard/civicrm-core/commit/f57954392f8026d17b7f19f7c01ceeb65e703384

Both of those could probably be merged upstream?

Process:

1. Build process to copy web assets to WEBROOT/libraries/civicrm so they are web accessible. Here's the version from roundearth's build process:

   # Copy CiviCRM assets
   asset_source=./vendor/civicrm/civicrm-core
   asset_dest=./web/libraries/civicrm
   mkdir -p $asset_dest
   rsync -mr --include='*.'{html,js,css,svg,png,jpg,jpeg,ico,gif,woff,woff2,ttf,eot} --include='*/' --exclude='*' $asset_source/ $asset_dest/
   rm -rf $asset_dest/tests
   cp -r $asset_source/extern $asset_dest/
   cp $asset_source/civicrm.config.php $asset_dest/
   cat << EOF > $asset_dest/settings_location.php
   <?php
   
   define('CIVICRM_CONFDIR', '../../../sites');
   EOF

2. Set the "Resource URL" to [cms.root]/libraries/civicrm/

Getting support for this upstream:

1. I think the patches might be good to just commit upstream? They don't seem controversial
2. The build process could be put in a PHP class in civicrm-corm which could be referred to as a script in a sites composer.json
3. We should be able to detect that we're using the vendor outside the webroot - could we somehow make the necessary "Resource URL" the default?