Composer update + leverage symfony/flex ~1.1

[nicolas-grekas]

No description provided.

[javiereguiluz]

Nicolas, I'm sorry but merging other pending PRs introduced conflicts in this one. Can you please take a look? Thanks!

[bobdenotter]

This PR will also fail tests, because when the doctrine/* packages get updated, you'll bump into the same issue as I did in #846 :

PHPUnit 6.5.11 by Sebastian Bergmann and contributors.

Testing Project Test Suite
..................................................                50 / 50 (100%)

Time: 1.03 minutes, Memory: 56.25MB

OK (50 tests, 92 assertions)

Remaining deprecation notices (1)

  1x: Doctrine\Common\ClassLoader is deprecated.
    1x in BlogControllerTest::testAdminBackendHomePage from App\Tests\Controller\Admin

I think we need to either selectively update symfony/* components, or lock the versions of doctrine/*, or do something similar as you did in symfony/symfony#28038

[stof]

The drawback of using * as Symfony constraint is that composer validate now complains about using unbounded constraint (and it is perfectly right about it).
Thus, any time you use composer require for new components, they would still get an actual constraint (unless you explicitly force *, but then you're responsible for the unbounded constraint).
I suggest keeping bound constraints.