title: Use "secure-http:false" for Composer used by Packagist
body: <p>I have Packagist set up to provide a local package system for our project, however the local Gitlab server only runs over <code>http://</code>. Where is the composer.json used by Packagist? And is this what I would add?</p>
  
  <pre><code>{
      "config": {
          "secure-http": false
      }
  }
  </code></pre>
  
  <p>For clarity, the error when I attempt to submit a repo to Packagist is:</p>
  
  <pre><code>Uncaught Exception: [Composer\Downloader\TransportException] Your configuration does not allow connections to http://custom-server/custom/repo.git. See https://getcomposer.org/doc/06-config.md#secure-http for details.
  </code></pre>