[Build] Keep composer.lock and keep a .gitignore.dist

As we now ship with a working composer setup it makes sense to
also ship with the resulting composer.lock file. While at it also
provide a copy of our .gitignore file for optional use.

1. Does this make sense for project use? It might be a bit painful for upgrades but it could make sense for new projects making it more clear they don't need to (and shouldn't) version vendor directory.

2. Should instead of renaming .gitignore we ship with it modified to not ignore composer.lock?