Add composer.lock file

Composer recommends that the lockfile be checked into version control
[1]. This ensures that we're all testing the same dependencies, and that
new installations don't run into version conflicts.

[1] http://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file