Add composer.lock to repository & add `vendor/*` to .gitignore

In order to correctly integrate the use of composer with the VCS, composer.lock should be put into the repository, and the `vendor/` directory, product of executing composer, put into `.gitignore`.

This allows a user to get a running copy of the code base without dirtying-up their tree.