composer.json: bump phpunit for use with latest, pessimistic versioning for phpcs

Addresses 1/2 of #4