use tilde version ranges in composer.json

This is one way to make sure that when 3.0 dev versions start happening you won't end up getting them until you want to.