add composer.lock to repo