moved dev requirements to require-dev in app composer.json

fixes #1736