Remove composer.lock from gitignore after create-project

Keep composer.lock in `.gitignore` so people won't push it back when contributing, but remove it on `composer create-project` so app developers don't have to delete it manually.

#3019