strip composer.lock in .gitignore