Composer packages do not obey archive exclusions in composer.json

Summary

The composer.json schema includes archive.exclude - an array of files that should not be included in package distros. Publishing Composer packages to the Gitlab Package Registry ignores these excludes, and includes ALL files - which means files and directories that have no business being included in distributions.

Steps to reproduce

Create a composer.json file and include an archive.exclude array, like so...

{
    "name": "mynamespace/mypackage",
    "type": "library",
    "license": "MIT",
    "description": "An example package with archive excludes.",
    "archive": {
        "exclude": [
            ".gitlab-ci.yml",
            ".idea",
            "package.json",
            "package-lock.json"
        ]
    }
}

Ensure the project has some of the excluded files in it, like .gitlab-ci.yml

Then publish the package to the Gitlab Composer Registry.

Add the package to another project using Composer.

Note that all the excluded files are still included in the package, including items like .gitlab-ci.yml!

What is the current bug behavior?

Composer packages pulled from the Gitlab Composer Registry include files that composer.json has been configured to exclude.

What is the expected correct behavior?

Files specified in composer.json's archive.exclude array must not be included in published packages.