Apply new dependencies policy

We no longer put composer.lock under version control and resort to
composer install. Instead, if a tool breaks often, we use tighter
version constraints for it.

.appveyor.yml

@@ -59,9 +59,8 @@ install:
 
     # install composer dependencies
     - cd C:\projects\migrations
-    - rm composer.lock
     - appveyor-retry composer self-update
-    - appveyor-retry composer install --no-progress --prefer-dist
+    - appveyor-retry composer update --no-progress --prefer-dist
 
 test_script:
   - vendor\bin\phpunit

.gitignore

@@ -11,5 +11,6 @@ phpunit.xml
 /.phpcs-cache
 /box.phar
 /box.json
+/composer.lock
 
 # Please don't add your IDE's files here, use global gitignore instead.

.travis.yml

@@ -16,7 +16,6 @@ before_install:
   - mv ~/.phpenv/versions/$(phpenv version-name)/etc/conf.d/xdebug.ini{,.disabled} || echo "xdebug not available"
 
 install:
-  - rm composer.lock
   - travis_retry composer update --prefer-dist
   - ./download-box.sh
 
@@ -28,7 +27,6 @@ jobs:
     - stage: Test
       env: DEPENDENCIES=low
       install:
-        - rm composer.lock
         - travis_retry composer update --prefer-dist --prefer-lowest
         - ./download-box.sh
 
@@ -45,10 +43,10 @@ jobs:
 
     - stage: Code Quality
       env: CODING_STANDARDS
-      install: travis_retry composer install --prefer-dist
+      install: travis_retry composer update --prefer-dist
       script: ./vendor/bin/phpcs
 
     - stage: Code Quality
       env: STATIC_ANALYSIS
-      install: travis_retry composer install --prefer-dist
+      install: travis_retry composer update --prefer-dist
       script: vendor/bin/phpstan analyse