add --prefer-lowest-stable to update command

Run `composer update --prefer-lowest-stable` and get all the deps installed to their lowest (pretended) supported version

Fixes #3440
Fixes #1902
Not sure to understand what you mean: this option is only for the "update" mode, thus composer.lock should not be used, if that's what you meant