drupal-phpunit-upgrade should also update prophecy

Problem/Motivation

Filing against 8.6.x (current release is 8.6.0) because we're going to be moving to PHP 7+ requirements in 8.7.x, and we might need this. https://www.drupal.org/node/2938726

Here's something to try:

Spin up your newest version of PHP dev environment. I'm using PHP 7.2.8.

Working Workflow

Let's install Drupal like everyone theoretically does:

$ composer install

[...]

  - Downgrading phpunit/phpunit (6.5.13 => 4.8.36): Loading from cache

Then we do the PHPUnit upgrade:

$ composer run-script drupal-phpunit-upgrade
Dependency "phpspec/prophecy" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/yaml" is also a root requirement, but is not explicitly whitelisted. Ignoring.

[...]

  - Updating phpunit/phpunit (4.8.36 => 6.5.13): Loading from cache

That's good and fine. We can run tests, and don't get an error message saying that we need to upgrade to PHPUnit 6 for PHP 7.2.

Broken Workflow

Reset our composer.lock file: git reset --hard

Install to minimum dependencies:

$ composer update --prefer-lowest --no-progress --prefer-dist

[...]

  - Downgrading phpunit/phpunit (6.5.13 => 4.8.35): Loading from cache

Now you'd *think* that performing the drupal-phpunit-upgrade script would give us PHPUnit 6.5.*. But it doesn't.

$ composer run-script drupal-phpunit-upgrade
Dependency "phpspec/prophecy" is also a root requirement, but is not explicitly whitelisted. Ignoring.
Dependency "symfony/yaml" is also a root requirement, but is not explicitly whitelisted. Ignoring.

[...]

  - Updating phpunit/phpunit (4.8.35 => 4.8.36): Loading from cache

And that's because when we got the minimum version of phpspec/prophecy, we trapped ourselves in the basement of version compatibility.

$ composer show phpspec/*
phpspec/prophecy 1.4.0 Highly opinionated mocking framework for PHP 5.3+

Prophecy 1.4.0 doesn't allow us to update to PHPUnit 6 due to intermediate dependencies.

This suggests a few things:

• We should probably pin phpspec/prophecy to ^1.7.0 in composer.json, since that's what we expect to work. It's the value in the lock file.
• We should also update prophecy in the drupal-phpunit-upgrade script. See that line in the composer output about it being a root requirement?
• We should also consider adding symfony/yaml to the drupal-phpunit-upgrade script for the same reason.

Proposed resolution

At minimum, add phpspec/prophecy to the drupal-phpunit-upgrade script.

This solves the problem in the short term.

Remaining tasks

Consider adding symfony/yml to drupal-phpunit-upgrade.

Update core/composer.json to match composer.lock when it comes to phpspec/prophecy.

User interface changes

API changes

Data model changes