Remove passwordlib/passwordlib since it's not needed for this package.

I was playing around with [Dependency Guard](https://github.com/mediact/dependency-guard) on a project, and it complained about an include. At first I thought that to be an error - see mediact/dependency-guard#19 - but as explained there, it's actually expected behaviour. This repo composer-requires `passwordlib/passwordlib`, while only `bolt/bolt` itself needs it (and already requires it itself).

I'm more than willing to cook up a PR, but before I do that 1. would you want me to and 2. against what branch?