add Release Checklist back to CONTRIBUTING.md

Also add new step regarding `composer.json`; refs #13385.
/cc @mdo