This disables security checks for the starter bundle endpoints

The main change is that the core bundle no longer contains tugraz
specifics, so we can remove the corresponding config.

This also pins api-platform/core since the new 2.6 release has various
breaking changes we haven't worked around yet.