Add composer.lock to repo to prevent potential breaking updates to unstable packages