Add phpunit to composer deps

This also removes `composer.lock` from `.gitignore`.