composer.json: requires minimum symfony framework-bundle versions CVE-2014-4931. fixes #23