adds composer.lock