Require a stable version of Drupal core

[MatthewWilkes]

This overrides the minimum stability for drupal/core-recommended to stable, to prevent locking to a dev release in cases where no stable version is an install candidate but an unstable one is (such as when there's a security release being prepared and a known-insecure conflict set like roave/security-advisories is being used).

[finnlewis]

@stephen-cox still wants to check this doesn't have any unintended implications.