Rationale on why is at T88436#1013289 and subsequent comments.
Instead of cloning mediawiki/vendor, we should run "composer update". If we are testing extensions, we should create a composer.local.json file that recursively includes those extension's composer.json files if they exist (pending patch).