update composer.json
Merge pull request #3376 from php-engineer/master-update-composer

update composer.json
Update docs for file().

Mention that relative paths will be prepended with APP.

Refs #3370
Reject file paths containing `..`.

Paths containing `..` are generally up to no good. Throw an exception,
as developers can use realpath() if they really need to get relative
paths.

Fixes #3370
Merge branch 'master' into 2.5