This took me two hours on stackoverflow.com, so I'm going to document it to future me:
In the composer.json require section, for all packages starting with symfony/, but not for symfony/monolog-bundle, change the required version to the value of the $VERSION environment variable.
Write out the updated composer.json file in a way that works _without sponge`, which is not installed on GitHub Action runners by default.