Installing require-dev dependencies from core/composer.json
By default, Composer will install also the development requirements, if you don't use the --no-dev option.
I ran  composer create-project drupal/drupal test 8.3.*@dev, and in the output of the command I could see the following:


  Installing drupal/drupal (8.3.x-dev
  8a84ec5556f354861f1ddc5d7a80081b91ca42df)
    - Installing drupal/drupal (8.3.x-dev 8a84ec5)
  Cloning 8a84ec5556 from cache
  Created project in test
  Loading composer repositories with package information
  Installing dependencies (including require-dev) from lock file
  Package operations: 76 installs, 0 updates, 0 removals
  
  [Omissis]
  
  
  Installing drupal/coder (8.2.11) Downloading: 100%
  Installing phpunit/phpunit (4.8.28) Downloading: 100%
  


If you downloaded the archived release for example from https://www.drupal.org/project/drupal/releases/8.2.7, which doesn't include the development requirements, you need to run composer update from the directory containing core and composer.json.
I tested composer update --dev after removing the vendor directory from the test directory created from the previous command, and I got this output:


  You are using the deprecated option "dev". Dev packages are installed by default now.
  Loading composer repositories with package information
  Updating dependencies (including require-dev)
  Package operations: 76 installs, 0 updates, 0 removals