Composer for 3rdparty

Addresses #11973 and is a variation of #12022.  It removes the 3rdparty submodule and uses composer to load 3rdparty dependencies.

Run `$ composer install` whenever switching branches.

Run `$ composer update` whenever modifying composer.json to generate a new composer.lock file and **always commit both files**.

#### Notes:
1. phppass is an outlier here and should be pulled in via composer as well.  Just need to move it to it's own repo or add it to packagist, then we can remove it from this repo's 3rdparty.
2. Travis will fail because it needs to run `$ composer install` (instead of `$ git submodule update`)
3. Before updating a working directory that has the 3rdparty submodule, you will need to `$ rm -rf 3rdparty`
4. It leaves the installation of composer up to the developer: [composer](https://getcomposer.org/doc/00-intro.md#installation-nix)
These are hardcoded versions and not the way the json file was designed to work. This should be something like "~1.0".