ci/tests: pin all test dependencies to fixed versions

[nodiscc]

• tests start failing for no apparent reason, all dependencies should be pinned #2137

[nodiscc]

I checked that there were no other problematic uses of composer update anywhere else (build tools, documentation) and everything appears clean.

All composer dependencies are properly pinned to major version, except roave/security-advisories which is designed to be installed from master (blocks installation of known vulnerable composer packages), and pubsubhubbub/publisher which has no tagged releases and hasn't been touched in years, so the risk is low.