Update composer.json

The `~4` should really be `~4.0` because `~4` implies it will work with version 5, 6, 7... too. I've also added some sensible version constraints for the dev dependencies. I hate to see dev-master used.