Fixes #5598: added ImageMagick with PNG and GD with FreeType checks to requirements of basic and advanced applications, used better Captcha exception message

Fixes #5088: new password reset token is now generated only if previous one was already used or expired

delete spaces

- in composer the `~` operator is just a shortcut for `~1.0` = `>=1.0.0,<2.0.0`
  it does not prevent dev versions to be installed but neither does `1.*`
- dev versions are constrolled via `minimum-stability` setting and the
  `@dev`, `@beta`, `@stable`,... settings.
- setting bower packages that ship compiled files only with the stable
  release to use `@stable` in composer.json of the applictaions. This
  setting can be removed when we remove the `minimum-stability=dev`
  setting after GA.

fixes #5119

Added `yii\composer\Installer::postCreateProject()` and modified the syntax of calling installer methods in composer.json [skip ci]

speed up process a lot because 3 composer updates are reduced to one

Used a single database and a single CLI entry point for all test types. Added faker to basic app dev requirements.