Put a higher prio on replacers of the same vendor as the required package

@ocramius reported a case where only requiring ZF components was installing some bad replacer from packagist. Yet if he required ZF itself, it was installing fine. The reason is simply that in this case it had to pick a replacer and did not prefer any, so it was just id based sorting. I think this patch makes it less likely that such accidents happen, even though it's not a bulletproof solution.