add composer.lock to version control