composer.json does not prevent upgrading Symfony components to minor versions that do not work with Drupal

Problem/Motivation

composer.json in HEAD does not prevent minor version updates to Symfony components. Historically and currently (as with Symfony 3.3), minor releases break Drupal.

Steps to reproduce

1. Clone Drupal.
2. composer update
3. Composer updates Symfony to 3.3 and Drupal is broken.

Being somewhat liberal about version constraints is a good thing but executing composer update ought to produce a working system.

Proposed resolution

Use the tilde "~" version constraint to allow only bugfix releases of Symfony components.

Another way of looking at it is that using ~ specifies a minimum version, but allows the last digit specified to go up.

— https://getcomposer.org/doc/articles/versions.md#tilde

Remaining tasks

Original report

After pulling down 8.4.x at commit c3f81d1, I ran composer update and attempted to reload the existing Drupal install.

The site threw the following fatal error:

Drupal\Core\Routing\Router::doMatchCollection(): The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "Drupal\Core\Routing\CompiledRoute" of the object you are trying to operate on was loaded _before_ unserialize() gets called or provide a __autoload() function to load the class definition  in /var/www/html/docroot/core/lib/Drupal/Core/Routing/Router.php on line 209

Trying a new install after composer update:

Error: Class 'Symfony\Component\Config\Resource\ComposerResource' not found in /Users/cjm/Sites/drupal8x/vendor/symfony/dependency-injection/ContainerBuilder.php on line 1444 #0 /Users/cjm/Sites/drupal8x/vendor/symfony/dependency-injection/ContainerBuilder.php(394): Symfony\Component\DependencyInjection\ContainerBuilder->inVendors('/Users/cjm/Site...')
#1 /Users/cjm/Sites/drupal8x/vendor/symfony/dependency-injection/ContainerBuilder.php(303): Symfony\Component\DependencyInjection\ContainerBuilder->fileExists('/Users/cjm/Site...')
#2 /Users/cjm/Sites/drupal8x/vendor/symfony/dependency-injection/ContainerBuilder.php(463): Symfony\Component\DependencyInjection\ContainerBuilder->addObjectResource('Drupal\\Core\\Dep...')
#3 /Users/cjm/Sites/drupal8x/core/lib/Drupal/Core/CoreServiceProvider.php(62): Symfony\Component\DependencyInjection\ContainerBuilder->addCompilerPass(Object(Drupal\Core\DependencyInjection\Compiler\ModifyServiceDefinitionsPass))
#4 /Users/cjm/Sites/drupal8x/core/lib/Drupal/Core/DrupalKernel.php(1273): Drupal\Core\CoreServiceProvider->register(Object(Drupal\Core\DependencyInjection\ContainerBuilder))
#5 /Users/cjm/Sites/drupal8x/core/lib/Drupal/Core/DrupalKernel.php(883): Drupal\Core\DrupalKernel->compileContainer()
#6 /Users/cjm/Sites/drupal8x/core/lib/Drupal/Core/Installer/InstallerKernel.php(18): Drupal\Core\DrupalKernel->initializeContainer()
#7 /Users/cjm/Sites/drupal8x/core/lib/Drupal/Core/DrupalKernel.php(465): Drupal\Core\Installer\InstallerKernel->initializeContainer()
#8 /Users/cjm/Sites/drupal8x/core/includes/install.core.inc(414): Drupal\Core\DrupalKernel->boot()
#9 /Users/cjm/Sites/drupal8x/core/includes/install.core.inc(114): install_begin_request(Object(Composer\Autoload\ClassLoader), Array)
#10 /Users/cjm/.composer/vendor/drush/drush/includes/drush.inc(726): install_drupal(Object(Composer\Autoload\ClassLoader), Array)
#11 /Users/cjm/.composer/vendor/drush/drush/includes/drush.inc(711): drush_call_user_func_array('install_drupal', Array)
#12 /Users/cjm/.composer/vendor/drush/drush/commands/core/drupal/site_install.inc(82): drush_op('install_drupal', Object(Composer\Autoload\ClassLoader), Array)
#13 /Users/cjm/.composer/vendor/drush/drush/commands/core/site_install.drush.inc(255): drush_core_site_install_version('standard', Array)
#14 /Users/cjm/.composer/vendor/drush/drush/includes/command.inc(422): drush_core_site_install('standard')
#15 /Users/cjm/.composer/vendor/drush/drush/includes/command.inc(231): _drush_invoke_hooks(Array, Array)
#16 /Users/cjm/.composer/vendor/drush/drush/includes/command.inc(199): drush_command('standard')
#17 /Users/cjm/.composer/vendor/drush/drush/lib/Drush/Boot/BaseBoot.php(67): drush_dispatch(Array)
#18 /Users/cjm/.composer/vendor/drush/drush/includes/preflight.inc(66): Drush\Boot\BaseBoot->bootstrap_and_dispatch()
#19 /Users/cjm/.composer/vendor/drush/drush/drush.php(12): drush_main()
#20 {main}
Error: Class 'Symfony\Component\Config\Resource\ComposerResource' not found in Symfony\Component\DependencyInjection\ContainerBuilder->inVendors() (line 1444 of /Users/cjm/Sites/drupal8x/vendor/symfony/dependency-injection/ContainerBuilder.php).