remove library files, adjust composer.json

For applications the `composer.lock` file should stay in the repository.