Commit `composer.lock`

[maxdeviant]

We currently have composer.lock ignored from the repository.

However, the Composer docs state that libraries can commit composer.lock: https://getcomposer.org/doc/02-libraries.md#lock-file

I think we should commit the lockfile to make dependency resolution more deterministic.

[lucasmichot]

Hey @maxdeviant, true for a project but for not for a library ⚠️