Properly define dependencies
@heddn raised this concern:
One of my concerns with using tagged releases of the template is it isn't easy to get global changes on your project from upstream. An example of beneficial global changes: all the deprecation testing that was added on drupalci. Using a composer plugin seems like we could control some of that.