Use --no-dev flag to reliably use :dev attribute

Since composer switched the default for dev dependencies in the update case, leaving out "--dev" no longer means it will not be used. This change uses "--no-dev" now, instead of simply leaving out "--dev" to make sure the Right Thing happens.