add --prefer-lowest and --prefer-stable to update command

Run `composer update --prefer-lowest-stable` and get all the deps installed to their lowest (pretended) supported version

Fixes #3440
Fixes #1902
Except preferLowest isn't on the root $package so you'll have to pass it in to the locker directly I guess.