add COMPOSER_PREFER_LOWEST_STABLE

Run `COMPOSER_PREFER_LOWEST_STABLE=1 composer update` and get all the deps installed to their lowest (pretended) supported version

Fixes #3440
Fixes #1902
In fact, I tried without prefer-stable, and I went back in `-rc` or `-alpha` state, which is certainly not what I'll ever want to test. So, if the only use case of this is testing want you pretend, I'm not sure that anyone will go up to supporting alpha versions