Fixes #4827: default config for functional tests of both basic and advanced app now turns off CSRF validation while providing commented out alternative setting cookie domain to localhost

Fixes #5598: added ImageMagick with PNG and GD with FreeType checks to requirements of basic and advanced applications, used better Captcha exception message

- in composer the `~` operator is just a shortcut for `~1.0` = `>=1.0.0,<2.0.0`
  it does not prevent dev versions to be installed but neither does `1.*`
- dev versions are constrolled via `minimum-stability` setting and the
  `@dev`, `@beta`, `@stable`,... settings.
- setting bower packages that ship compiled files only with the stable
  release to use `@stable` in composer.json of the applictaions. This
  setting can be removed when we remove the `minimum-stability=dev`
  setting after GA.

Added `yii\composer\Installer::postCreateProject()` and modified the syntax of calling installer methods in composer.json [skip ci]

Used a single database and a single CLI entry point for all test types. Added faker to basic app dev requirements.

Exposed basic app entry URL via codeception.yml, refactored configs of advanced app to read from config and define entry script in a single place

- Moved everything test-related into `tests` directory. Codeception tests are in `codeception`.
- Removed database module since we're using fixtures and migrations.
- Moved console entry points and bootstrap into `tests/codeception/bin`.
- Adjusted travis build scripts.
- Adjusted documentation to be consistent and reflect changes made.