docs(php-sample-app): clarify build.sh is always required

[Kyle-Neale]

The sample app's README currently frames ./build.sh as needed "so the app can be staged on offline Cloud Foundry environments" — implying it's optional online. In practice it's always required, because php_buildpack's own composer install writes to lib/vendor/, but htdocs/index.php loads ../vendor/autoload.php (i.e. ./vendor/). Without build.sh the app boots with PHP Fatal error: Failed opening required '/home/vcap/app/htdocs/../vendor/autoload.php'.

This PR tightens the wording to state the autoload requirement up front and keeps the offline-staging note as a secondary benefit.

Surfaced while verifying #257 on TAS 10.4 (bark-12516): an initial push without build.sh returned HTTP 500 for that exact reason.

[Kyle-Neale]

Superseded by #257, which fixes the underlying vendor-path mismatch rather than documenting it as a permanent constraint.

Pinned composer's vendor-dir to lib/vendor in composer.json and updated htdocs/index.php to require from that path — so php_buildpack's staging-time composer install and the sample app now agree on where the autoloader lives. cf push works standalone in online envs, verified today on page-13163. The original README wording (build.sh needed only for offline envs) is accurate again with #257 applied.