Previously we only allowed removing components, now the repository
vendor can also inject arbitrary additional data into <custom/> tags.
The only current limitation is that data needs to be reprocessed for a
particular component so changes to a <custom/> tag are applied.
