Add composer.lock for Scrutinizer

PHP Analyzer fails because of ext-imap, which is unavailable on Scrutinizer.
The only option is to commit composer.lock. See also
https://scrutinizer-ci.com/docs/tools/php/php-analyzer/guides/composer_dependencies
and https://getcomposer.org/doc/02-libraries.md#lock-file.