Strategy for composer dependencies

[davidcoutadeur]

It's the same issue as for https://github.com/ltb-project/self-service-password/issues/929

This issue is here to discuss the strategy for composer dependencies.

I think it is preferable to let people generate composer.lock by themselves. This implies:

• [x] removing composer.lock
• [x] add composer.lock into .gitignore
• [x] add a note in documentation to tell people to make composer update