Remove composer.lock from gitignore

This PR removes the lockfile from .gitignore, mentions not committing it in contributing.md and excludes it from git-archive, meaning that if it is accidentally committed most users won't download it.

---

This issue tripped me up again today - wondering why my tiny 512MB instance couldn't install Composer dependencies (doesn't need a ton of memory if you have a lockfile :smile:). Modifying .gitignore is the first thing I have to do each time I start a project.

From #2293 the consensus seems to be that the lockfile shouldn't be in .gitignore. While this project only has one dependency it probably shouldn't have a lockfile either (I think that laravel/framework should but that's a different issue).

Additionally, most people get this repo from GitHub as an archive or from `composer create-project` which gets the same archive by default. This is handy as we can [exclude files from git-archive](https://www.kernel.org/pub/software/scm/git/docs/gitattributes.html#_creating_an_archive) (what GitHub uses to create the archives). Even if the lockfile *is* committed, unless the user clones the repo or uses `--prefer-source` (for whatever reason) they won't end up with a stale copy.

---

I don't know why it says there's an error checking the merge status, but I'm assured not to worry, so I won't.