Revert composer.lock addition, unclear usage, breaks builds

Partially reverts e9f13512dcd7ec6cf6e916c07ce0375a62c34c13

This caused two issues in Travis builds:
 * CMS builds were using
outdated framework dependencies. Example: https://travis-ci.org/silverstripe/silverstripe-cms/jobs/7718686
 * Modules weren't building
at all because the info in the lock file overwrote the custom
composer.json. Example: https://travis-ci.org/silverstripe/silverstripe-translatable/jobs/7726954

In addition, I don't agree with having lock files on release branches
(as opposed to tags), since it forces us to permantently update lock
files or work with stale dependencies even when on branches
(most likely not the developers intention).
Merge remote-tracking branch 'origin/3.0' into 3.1
BUG Prevent VCS from being accessed via HTTP.