Libraries should not have composer.lock

It has no effect in projects that depend on this library and hinders testing against a wider variety of dependency versions