Brief summary of changes

• Allow additional composer deps to be managed in project/ without the need to override the main composer.json.
• Adds the documentation section to cover how to override LORIS.

Testing instructions (if applicable)

1. create a project/composer.json with additional deps.
2. run composer update

Related PR

Reopening #8319 as a new dependency is needed in HBCD.