Update Composer advice

Notable changes:
* Use composer itself to create `composer.json` file.
* Brief mention of flexible versioning
* Brief mention of the security advisory checker
* Brief mention of how to update