composer.lock update for mustache and symfony/finder versions