add COMPOSER_PREFER_LOWEST_STABLE

Run `COMPOSER_PREFER_LOWEST_STABLE=1 composer update` and get all the deps installed to their lowest (pretended) supported version

Fixes #3440
Fixes #1902
Yeah that's what I meant, currently it's called LOWEST_STABLE so that makes sense, but maybe we should support both LOWEST and LOWEST_STABLE?