some updates to composer.json

What does this MR do?

made composer installation procedure more strict and more secure (less prone to mistakes).

How confident are you it won't break things if deployed?

looks good.

Checklist

• added a test, or explain why one is not needed/possible... (visibly tested, our tests should cover it all)
• no unrelated changes
• asked someone for a code review
• joined #foodsharing-beta channel at https://slackin.yunity.org
• added an entry to CHANGELOG.md (description, merge request link, username(s))