add --prefer-lowest-stable to update command

Run `composer update --prefer-lowest-stable` and get all the deps installed to their lowest (pretended) supported version

Fixes #3440
Fixes #1902
This code doesn't actually get run for current lock file formats?