EZP-22139: require nelmio/cors-bundle @dev

Since nelmio/NelmioCorsBundle#16 has been merged to master, bumping the requirement so that QA can test the merged version before it gets tagged.