INFRA-128 Buildkit should maintain evergreen composer
Buildkit attempts to do some self-updating (e.g. every invocation of "civibuild" implicitly calls "civi-download-tools -q") -- e.g. if there's a change in composer.json/composer.lock, then it automatically runs "composer install". (Similarly, if an extern changes, it redownloads the extern.)
Additionally, it should (but does not currently) run "composer self-update" periodically (e.g. every 2 weeks). (Currently, we can wind up with mismatches where the composer.json/composer.lock is updated in git but the local composer-binaries are old.)
(Aside: We should also ensure that civibuild skips civi-download-tools when OFFLINE=1.)