adding composer.lock to tracking