Make root alias behaviour consistent, add root ref handling, lock to newest metadata

root aliases during install should come from the lock file only, for
better reproducibility we don't reuse the value from update for the
following install

src/Composer/Repository/RepositorySet.php

@@ -101,6 +101,8 @@ class RepositorySet
     /**
      * Find packages providing or matching a name and optionally meeting a constraint in all repositories
      *
+     * Returned in the order of repositories, matching priority
+     *
      * @param string $name
      * @param ConstraintInterface|null $constraint
      * @param bool $exactMatch