Composer And Travis Updates

I've found the composer.lock useful in the build process, because it seems to avoid doing any packagist lookups.  If "install" doesn't have the lockfile, it's effectively an "update" as best I can tell from watching it run.  "install" + "lockfile" means everything installs from cache, no packagist hits.. again, as best I can tell.  It's easy to tell, though, because every packagist lookup from my company network borders on 30sec a hit.