Fix http-kernel dep in symfony/security

The current constraint will not match 2.3.x-dev and cause edge cases
where either:

* composer falls back to symfony/symfony because it cannot find a match
* composer installs 2.2 versions of http-kernel and http-foundation