Include ssh-based urls in composer metadata source payload

Problem

In #247531 (closed) we added source to the composer metadata payload to support the --prefer-source option. The first iteration includes the https url for cloning a repository. The problem is composer may prompt for login depending on the visibility of the project.

Solution

Composer also supports ssh urls for private repositories so users can have an ssh key configured and successfully clone the repo. The source section of the metadata is generated here.

Considerations

If a package is completely public, using the ssh url will require a valid ssh key, so http url is preferred. If a package is private, ssh is preferred.

We could look at the visibility of the project when deciding which URL to return.