composer: update mustache to 2.3.x; update composer.lock