Track composer.json and composer.lock
Prevent unintended updates to libraries

This no longer runs `composer update` on plugins.  Nor do we generate a master composer.json file anymore.  Instead, let plugins commit a composer.json and composer.lock file, and then run `composer install` on them, so that we can ensure that the same libraries are installed every time.
Auto-include composer autoload files
Track composer.lock and composer.json files