clarify what "dependencies" are.

One could think these are composer dependencies and run the install
subcommand of Composer, which will inevitably fail because of virtual
packages. This might change if Composer improves in the future.
Explain the composer.json change

Giving a clear explanation about this change and instruction will avoid
unwanted composer.json commits.
Merge pull request #509 from greg0ire/contributing

Contributing