Do not ignore composer.lock, update README.md

- As this is intended to be a project skeleton, it should not ignore
 composer.lock; as this then leads to projects created using the skeleton to
continue doing so
- Update README.md to add a `composer update` command in the appropriate
 places. This will keep the project up-to-date