Lock project dependencies in composer.lock