Remove composer.lock from version control

Committing `composer.lock` to version control can "help your team to
always test against the same dependency versions". However, new
projects that depend on this library aren't affected by it, and will
merge the requirements in `composer.json` with all others for the
project.

Since this creates more stability for testing, and less stability for
real-world use, it should be adjusted to make the testing environment
more similar to the experience of first-time users, and not have the
luxury of the specific versions in `composer.lock`.

.gitignore

@@ -9,3 +9,8 @@
 # users to have a local, custom phpunit.xml for use during development
 # which overrides phpunit.xml.dist
 /phpunit.xml
+
+# composer.lock is only used in CI for this project, and is ignored
+# when depending on this package. Ignoring it ensures that our CI is as
+# close as possible to real-world use
+/composer.lock