Require phpunit for dev, don't include the composer.lock