Don't version-control composer.lock