Add composer.lock in VCS

[gianarb]

composer.lock is a bad practice if you are working on a library. an application requires composer.lock to build the correct depependecies. This is an application

[Maks3w]

While I agree the documentation does not offer the install the tool as library, the fact is the authors use the tool as dependency https://github.com/zfcampus/zf-apigility-skeleton/blob/master/composer.json#L36

So the need of test the latest dependencies still be necessary.