Fix composer.json definitions

| Q             | A
| ------------- | ---
| Doc fix?      | [yes]
| New docs?     | [no]
| Applies to    | [2.3.6]


In order the make the cart-bundle installable I had to force several dependencies at @dev stability. I guess the same issue should hit every Symfony installation with "minimum-stability": "stable".
Also ~1.0@dev doesn't seems to be a valid release for leaphly/cart-bundle that is currenty tagged as 0.1.*@dev