Remove composer.lock from version control

Committing `composer.lock` to version control can "help your team to
always test against the same dependency versions". However, new
projects that depend on this library aren't affected by it, and will
merge the requirements in `composer.json` with all others for the
project.

Since this creates more stability for testing, and less stability for
real-world use, it should be adjusted to make the testing environment
more similar to the experience of first-time users, and not have the
luxury of the specific versions in `composer.lock`.