Move tmhOauth to a Composer dependency

Also it's good practice to track the `composer.lock` file to avoid Composer pulling different dependencies that the last ones you assured worked.