Fixed the composer requirement for phpseclib

The new constraint has several advantages:
- it allows using stable releases instead of forcing the dev version (easier when including Box as a requirement)
- it uses the branch alias for master (so an upper bound) instead of assuming that the current Box releases will be compatible with BC breaking changes in phpseclib master in the future.