Added --no-update hint to composer docs

Composer has recently changed their default behaviour. See https://github.com/composer/composer/issues/1005 and https://github.com/composer/composer/pull/1644 for context.

It installs dev dependencies by default on any `composer update`. By extension, this also includes calls to `composer require`, since those update existing dependencies first. Not the best default behaviour for us, particularly because we have quite a chain of dev dependencies through phpunit and behat. 

This greatly reduces the usefulness of `composer require` to us, because it takes module installation from a few seconds to 2+ minutes (at least the first time). Plus it adds all kinds of cruft which is probably not required for most of our devs using `composer require`.

I've updated the docs to reflect this, but its ugly/confusing. I'm actually tempted to remove the `require--dev` sections from our composer declarations, or at least move them to `suggests`. If you want to contribute to SS (e.g. run tests), you can achieve the same project state with two or three calls like `composer require phpunit/phpunit`.

@simonwelsh I know you voiced your frustration with this on github - would this be a feasible solution?

@sminnee What do you think?