ignore composer.lock

Facts:

1. When WP-CLI isn't installed as the root package, composer.lock is
ignored.

2. The wp-cli.org installer doesn't install WP-CLI as the root package,
but as a dependency.

1. + 2. => Having composer.lock under version control gives a false
sense of security. Instead, we should take more care with how we define
dependencies in composer.json

.gitignore

@@ -1,3 +1,4 @@
+composer.lock
 composer.phar
 /vendor
 /phpunit.xml