composer.lock composer.phar vendor