Avoid dev-master requirement for Guzzle

The previous commit which necessitated dev-master is now in 3.5.0.
The requirement can now be relaxed to ~3.5, which is short for both
>=3.5 and <4.0.
Remove composer.lock from version control

Committing `composer.lock` to version control can "help your team to
always test against the same dependency versions". However, new
projects that depend on this library aren't affected by it, and will
merge the requirements in `composer.json` with all others for the
project.

Since this creates more stability for testing, and less stability for
real-world use, it should be adjusted to make the testing environment
more similar to the experience of first-time users, and not have the
luxury of the specific versions in `composer.lock`.