EZP-22139: require nelmio/cors-bundle @dev

So that QA can test the merged version before it gets tagged.