Issue #3198340 by alexpott, xjm, Mile23, cilefen, mmjvb, catch, Mixologic,...

Issue #3198340 by alexpott, xjm, Mile23, cilefen, mmjvb, catch, Mixologic, effulgentsia, mfb, longwave, larowlan, greg.1.anderson, Warped, quietone: Strict constraints in drupal/core-recommended make it harder for Composer-managed sites to apply their own security updates when a core update is not available