Pin php-coveralls to specific commit

VersionEye will notify me if a new version is available. Then I can
decide if I want it or not. dev-master could be dangerous.
Pin Mockery to a specific commit

This will help move to a tagged Mockery release.
Remove composer.lock from version control

Committing `composer.lock` to version control can "help your team to
always test against the same dependency versions". However, new
projects that depend on this library aren't affected by it, and will
merge the requirements in `composer.json` with all others for the
project.

Since this creates more stability for testing, and less stability for
real-world use, it should be adjusted to make the testing environment
more similar to the experience of first-time users, and not have the
luxury of the specific versions in `composer.lock`.