Strategy for composer dependencies

[davidcoutadeur]

It's the same issue as for ltb-project/self-service-password#929

This issue is here to discuss the strategy for composer dependencies.

I think it is preferable to let people generate composer.lock by themselves. This implies:

• removing composer.lock
• add composer.lock into .gitignore
• add a note in documentation to tell people to make composer update