Loosen composer/semver constraints to ^1 || ^3

Problem/Motivation

Follow up from #3128631: Update dependencies composer/composer ^2 and composer/semver to ^3 → .

Loosening our constraints would allow contrib projects with a dependency on composer/semver ^1 to continue installing on PHP 7.4.

The downside to this is that we don't have min/max testing yet, but composer/semver is less likely to cause a problem than most other dependencies we rely on in this regard, and we'd still be relying on composer.lock for packaging.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet