Put composer.lock under revision control, refs T539

Summary:
Adding `composer.lock` to the repository makes `composer install` much faster.

Using `composer update` should only be used to update the locked versions or after changing `composer.json`.

Test Plan:
Check out a fresh version of and run

```
arc patch --nobranch D268
bin/update deploy
```

Reviewers: rjmackay, bodacea

Subscribers: spaudanjo, srutto, eyedol, dkobia

Maniphest Tasks: T539

Differential Revision: https://phabricator.ushahidi.com/D268