How to sort issues over authorship in my manuscript with PhD supervisor?
It's unethical to include the name of a collaborator who contributed nothing to a particular paper as a co-author. However, as you said, it can be difficult to confront your advisor about including someone else as a co-author.
If you are the person responsible for submitting the manuscript to the journal, one alternative you might have available is to ask your advisor is to have an explicit assignment of duties in the cover letter for your paper. ("Author A did activities Q, R, and S, while author B did T and U, etc.") The tasks of each author would be provided in such a manner—and in principle it would be hard to justify the inclusion of someone unqualified to be a co-author when you have to "certify" it to the journal, rather than just providing a generic statement of authorship.
If the advisor is unwilling to come up with such statements, then you could make the argument that since it's typically a requirement of journal submissions nowadays, that you're uncomfortable including an author whose contributions can't be clearly delineated.
Unfortunately this sort of resume padding seems to be getting more common, and as stated already, it is a form of academic fraud.
The question you should ask yourself is whether you really want to continue working with this supervisor. Even if you get this issue resolved amicably (and after the supervisor invents fake contributions for the third party involved, this does not look likely), there will be other problems down the road. Since you are clearly unable to work this out with your supervisor (in response to your objections, he upped the ante by inventing contributions for the third party), the next stop would be a higher authority, such as the Dean, the University ethics committee, ombudsman or similar, possibly the funding agency. But this is bound to get ugly.
That this is presented as some sort of "tradition", does not make it less of a fraud -because it is fraud, pure and simple. In fact, since it appears that a whole Department practices it, it is conspiracy to commit fraud, with the criminal intent to share in the benefits from it.
Are such words unwarranted? Do they seem, even, insulting to the members of the Department? Well, reality can be insulting at times, if one chooses to make it so.
That assigning authorship when none exists is strongly discouraged (to now use less harsh words), can be found on numerous relevant guidelines all over the world and the web. For just one such example, Yale University web page states
Authorship Standards. Authorship of a scientific or scholarly paper should be limited to those individuals who have contributed in a meaningful and substantive way to its intellectual content. All authors are responsible for fairly evaluating their roles in the project as well as the roles of their co-authors to ensure that authorship is attributed according to these standards in all publications for which they will be listed as an author.
Requirement for Attribution of Authorship Each author should have participated sufficiently in the work to take public responsibility for its content. All co-authors should have been directly involved in all three of the following:
planning and contribution to some component (conception, design, conduct, analysis, or interpretation) of the work which led to the paper or interpreting at least a portion of the results;
writing a draft of the article or revising it for intellectual content; and
final approval of the version to be published. All authors should review and approve the manuscript before it is submitted for publication, at least as it pertains to their roles in the project.
Some diversity exists across academic disciplines regarding acceptable standards for substantive contributions that would lead to attribution of authorship. This guidance is intended to allow for such variation to disciplinary best practices while ensuring authorship is not inappropriately assigned.
"Did nothing" appears to be a weak argument in favor of assigning authorship to somebody.
You are not the first person to face such situations, and really, there is not a roundabout way to "solve" this: You will either
A) "respect the tradition", risking consequences whose burden only you can assess, or
B) attempt to stand up against it, again risking consequences whose burden only you can assess.
Obviously, there are consequences in both routes taken - the issue is which kind of consequences you are willing to bear.
Responding to @aeismail criticism (whom I also thank for the positive words), "falsifying reality with intent to gain in collaboration with others, while disregarding the possible harm", is exactly what happens here. Crimes have "levels of seriousness" of course. Then, it is my impression that falsifying the scientific record, including researcher credentials, ends up killing innocent people, one way or the other, immediately or in twenty years time, directly or indirectly. I could, for the shake of accuracy, change "criminal conspiracy" to "criminal negligence for possible harm done to third parties while committing an unlawful act"... hmm, that's two charges, now that I think of it.