Add "--dry-run" to bump command

[kubawerlos]

With this flag it would be possible to run composer bump --dry-run as a part of CI - to keep synced composer.json and composer.lock.

When run on this repo:

$ php ./bin/compile 
$ php composer.phar bump --dry-run
Warning: Bumping dependency constraints is not recommended for libraries as it will narrow down your dependencies and may cause problems for your users.
./composer.json would be updated with:
 - require.composer/ca-bundle: ^1.3.3
 - require.composer/semver: ^3.3.2
 - require.justinrainbow/json-schema: ^5.2.12
 - require.psr/log: ^1.1.4 || ^2.0 || ^3.0
 - require.seld/jsonlint: ^1.9
 - require.seld/phar-utils: ^1.2.1
 - require.symfony/console: ^5.4.12 || ^6.0.11
 - require.symfony/filesystem: ^5.4.12 || ^6.0
 - require.symfony/finder: ^5.4.11 || ^6.0
 - require.symfony/process: ^5.4.11 || ^6.0
 - require.react/promise: ^2.9
 - require.symfony/polyfill-php73: ^1.26
 - require.symfony/polyfill-php80: ^1.26
 - require.seld/signal-handler: ^2.0.1
 - require-dev.symfony/phpunit-bridge: ^6.1.3
 - require-dev.phpstan/phpstan: ^1.8.3
 - require-dev.phpstan/phpstan-phpunit: ^1.1.1
 - require-dev.phpstan/phpstan-strict-rules: ^1.4.3
 - require-dev.phpstan/phpstan-symfony: ^1.2.13
$ echo $?
1

I've swapped the order of if (!$input->getOption('dev-only')) and if (!$input->getOption('no-dev-only')), so when there are packages in both to update then require is shown first.

[cafferata]

Nice! I also played with this idea so that my colleagues can guarantee the Composer bump (from CI)

[Seldaek]

Looks good overall, thanks, just the couple nitpicks :)

[Seldaek]

Thanks