add --prefer-lowest and --prefer-stable to update command

Run `composer update --prefer-lowest-stable` and get all the deps installed to their lowest (pretended) supported version

Fixes #3440
Fixes #1902
Would you mind adding prefer-lowest support for the lock file? I understand it's probably not a common use case or none at all but for completeness and to avoid bad surprises it should be persisted to the lock. See a few lines above..