Fixes #5088: new password reset token is now generated only if previous one was already used or expired

delete spaces

- in composer the `~` operator is just a shortcut for `~1.0` = `>=1.0.0,<2.0.0`
  it does not prevent dev versions to be installed but neither does `1.*`
- dev versions are constrolled via `minimum-stability` setting and the
  `@dev`, `@beta`, `@stable`,... settings.
- setting bower packages that ship compiled files only with the stable
  release to use `@stable` in composer.json of the applictaions. This
  setting can be removed when we remove the `minimum-stability=dev`
  setting after GA.

fixes #5119

Added `yii\composer\Installer::postCreateProject()` and modified the syntax of calling installer methods in composer.json [skip ci]

speed up process a lot because 3 composer updates are reduced to one

Used a single database and a single CLI entry point for all test types. Added faker to basic app dev requirements.

Exposed basic app entry URL via codeception.yml, refactored configs of advanced app to read from config and define entry script in a single place