Update the composer stuff in Travis

[oliverklee]

We should make sure that the application works both with the lowest allowed stable version of the dependencies as well as the latest ones. According to Nils Adermann, we also should commit the composer.lock. I'll need to read up on that before doing anything in that direction.

http://naderman.de/slippy/slides/2017-07-13-T3DD17-Composer-Best-Practices.pdf
https://evertpot.com/testing-composer-prefer-lowest/