Update deps constraints for Symfony 2.x

Updates composer.json for Symfony2.3.
It's fine to use <3.0 I guess, as from 2.3 new releases should keep backward compatibility.