As well as updating production dependencies in the "require" section of
a `composer.json` file, we also want to ensure we're keeping development
dependencies in the `require-dev`[1] section up to date (e.g., PHPUnit).

We can safely attempt to update both sections because if a dependency
exists in both require and require-dev, composer will complain about
conflicts itself, so there shouldn't be any composer.json files in that
state.

[1]: See: https://getcomposer.org/doc/04-schema.md#require-dev