Problem
The current use of composer provides a simple way of building out Drupal core's dependencies. However, putting all vendor libs under core/vendor prevents contrib from extending these with additional libraries.
The current suggested method for contrib, is to put a composer.json into each module, and run them separately. However, this does not make use of the dependency resolution of composer. If module x depends on version 1.0 of lib y, and module z depends on 1.1 of lib y, the first one PHP loads wins. This makes it difficult to debug.
Proposed Solution
In order to make use of composers dependency resolution, we should have:
* an additional per-install composer.json in the project root, that references Drupal's core composer.json as a dependency
* a unified /vendor directory with all of core's dependencies, plus any others from contrib
Site builders would add their additional library dependencies to the 'project' composer.json and let composer do the work of resolving dependencies.
Currently, site builders who use contrib modules (such as search_api_solr) need to download these external libraries manually, and typically put them in sites/all/libraries. This would create a unified method of getting external libraries that integrates with core.