Track composer lock

We should track composer.lock for installing exact packages.