This disables security checks for the starter bundle endpoints

The main change is that the core bundle no longer contains tugraz
specifics, so we can remove the corresponding config.

This also pins api-platform/core since the new 2.6 release has various
breaking changes we haven't worked around yet.

chore(deps): update all non-major dependencies

See merge request dbp/middleware/dbp-api/api-server-template!8

chore(deps): update all non-major dependencies

See merge request dbp/middleware/dbp-api/api-server-template!7

chore(deps): update all non-major dependencies

See merge request dbp/middleware/dbp-api/api-server-template!5

Update all non-major dependencies

See merge request dbp/middleware/dbp-api/api-server-template!4

Update dependency vimeo/psalm to v4.4.0

See merge request dbp/middleware/dbp-api/api-server-template!3

Update all non-major dependencies

See merge request dbp/middleware/dbp-api/api-server-template!1

See https://github.com/vimeo/psalm/issues/4961

So it doesn't default to the directory name and clashes with other
projects.

No need to duplicate this everywhere

We require php7.3 now

Ideally we should fail gracefully when they are not defined..