Include composer.lock

Related to #470, as per composer doc, the composer.lock should be checked in:
https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file

It will make sure everyone checked out one version will have the same
dependencies. It will also speed up the installation process
dramatically.