Fixes #6103: Improved codeception config in app templates to ease testing of advanced app on multiple hosts

Fixes #4827: default config for functional tests of both basic and advanced app now turns off CSRF validation while providing commented out alternative setting cookie domain to localhost

Fixes #5598: added ImageMagick with PNG and GD with FreeType checks to requirements of basic and advanced applications, used better Captcha exception message

Fixes #5088: new password reset token is now generated only if previous one was already used or expired

delete spaces

- in composer the `~` operator is just a shortcut for `~1.0` = `>=1.0.0,<2.0.0`
  it does not prevent dev versions to be installed but neither does `1.*`
- dev versions are constrolled via `minimum-stability` setting and the
  `@dev`, `@beta`, `@stable`,... settings.
- setting bower packages that ship compiled files only with the stable
  release to use `@stable` in composer.json of the applictaions. This
  setting can be removed when we remove the `minimum-stability=dev`
  setting after GA.

fixes #5119

Added `yii\composer\Installer::postCreateProject()` and modified the syntax of calling installer methods in composer.json [skip ci]