Move some Package Manager validation into the pre-require and status check event listeners

Copying comment across from ✨ Make Package Manager more friendly to local development by allowing stages to operate directly on the codebase in some situations Active and bumping this to critical.

I had a quick look for validators that would be affected by this change (e.g. not run at all if this is used). The three I could find were:

EnabledExtensionsValidator
DuplicateInfoFileValidator.php
SandboxDatabaseUpdatesValidator

EnabledExtensionsValidator seems like the main problem.

https://www.drupal.org/project/pathauto/releases/8.x-1.11 → removes a ctools dependency, and will remove it as a composer dependency in a major release. This means that when sites eventually update to pathauto 2.x, they'll need to either composer require drupal/ctools or uninstall it (unless they happen to have another module installed that depends on it).

Automatic updates can't do any of that itself, so would need to rely on this validator to handle it (and then the site owner would be alerted they need to either install ctool explicitly or uninstall it before trying to update pathauto again, after which it would work), but that won't run in direct write mode. @phenaproxima pointed out that composer update --dry-run doesn't support machine readable output, so this might need a composer update --dry-run:json custom composer plugin in order to replace.

However, neither that, nor SandboxDatabaseUpdatesValidator are relevant to project browser. After writing that I realised it might be relevant, because if you install a project that depends on pathauto 2.x, and you have pathauto 1.x installed, then composer might update you to pathauto 2.x even though the command in composer require which could also result in ctools removal.

I think we need a follow-up to discuss this more, and maybe postpone implementing the API in project browser and especially automatic updates on that follow-up.