Make puli dependency flexible again

[dbu]

in #40 we locked to specific versions to avoid unstable versions. we need to revert that again.

see also #41, where we might clean up what we depend on.

[sagikazarmark]

@dbu what needs to be done here?

[dbu]

i think that was what you just did. i guess we can create a new issue to remove puli.phar from the repo once puli can download itself