Leverage stricter 8.x dependencies

Per @gaborhojtsy:

relying on https://github.com/webflo/drupal-core-strict would help to augment pre 8.5 branches or releases of 8.5 prior to this one

This would have a stricter definition of what is found in core's composer.lock file, which could be used to more strictly interpret composer requirements. Such an approach could mitigate something like this: https://www.drupal.org/project/drupal/issues/3039408

As I can tell, the branches in that project correspond to releases of core. If a user specifies a *specific* release of core (not a branch) or does not specify one (use latest known core release), we have a defined version to require this project. If one is using a branch, I don't see how that's possible with the project, so we would not require it.

Does this approach seem correct?