Check for VCS reference difference in command 'status'

Composer status detects only uncommited changes for VCS packages. This patch
adds informations about different reference versions.
If a package has no uncommited changes, but differs from the
revision defined in composer.lock, a change message is triggered.

This commit is related to #1968

Missing pieces:
* Perforce support
* It might be better to add a separate abstract function to VcsDownloader for this check (reuse)
* Test case for new behavior
shell escaping does not use ``'`` on Windows. You should use ``escapeshellargs`` instead of doing it by hand to work cross-platform