composer.json - Patch URLs should be more concrete, less symbolic

composer.json - Patch URLs should be more concrete, less symbolic

The previous commit made used patch URLs in the format:

`https://raw.githubusercontent.com/civicrm/civicrm-core/master/{FILEPATH}`

This is symbolic in that the `master` does not refer to a specific piece of content; it refers
subjectively to the current developmental code. This creates a few problems:

* When `civicrm-core` is tagged or branched, the `composer.json` still points
  to `master`.
* If you need to update the patch-file, you send in a PR with a different
  patch URL, right? But any builds based on this PR would still use the
  canonical `master` rather than the proposed revision.

Resolution: Don't point to patch-files symbolicly.  Instead, address them
specifically.  This revision uses past Github commits (because that's easy),
but it doesn't have to be in Github per se.  It should be somewhere that's
reliable and unlikely to change (preferrably with addressing by content
checksum).  In the Drupal community, you see a lot of examples pointing to
file-attachments in the issue-tracker.