Add composer.lock to assure we are using working versions of dependencies.

Signed-off-by: Max Fierke <max@maxfierke.com>