Remove composer.lock

Seems the little rascal snuck back into the upstream
within c5cc9cb. I really don't want to commit it but
adding it to .gitignore will cause hassle each time
a concrete site utilises the skeleton.