While we directed the docker image to translate the URLs to https anyway
this can be confusing since git behaves differently in docker vs outside.

Also in the meantime we have made all repos public, so there is no auth needed
for the repos and the extra work required using https no longer applies.

This disables security checks for the starter bundle endpoints

The main change is that the core bundle no longer contains tugraz
specifics, so we can remove the corresponding config.

This also pins api-platform/core since the new 2.6 release has various
breaking changes we haven't worked around yet.