Allow plugins to register commands

This PR will move plugins to a next level by exposing the application to the plugins (and also loads the plugins BEFORE the application starts).

It might be a start to solve few tickets like #3312 or https://twitter.com/lsmith/status/526053583834603520
ping @lsmith77

It should also fixes #1234, #2761

Sample of use
```
composer global require FriendsOfPHP/security-advisories
cd my/project
composer security-check
```

Or with the sensiolab's secret project
```
composer global require sensiolabs/secret-project
composer play path/to/a/script.php
```

Want to simply test  it see a sample plugin (https://github.com/jeremy-derusse/composer-plugin)
```
composer global require jderuse/plugin
composer demo:greet
```

Todo
* [x] Add tests
* [x] Refactor the "plugins warmup" thing

IMHO, the factory was not the right place for this validation. And avoid to use commands from plugins which didn't need composer.json to works.

I moved it to the the installCommand. May be I should also add this validation in others commands like update.

What do you think @stof ?