While trying out latest `main`, it became evident that CI is not really stable, in its current
state, because dependencies like `phpunit/phpunit`, `vimeo/psalm`, `phpstan/phpstan` and `squizlab/php_codesniffer`
keep shifting within the boundaries of `composer.json`.
In order to freeze them in place, `composer.lock` is introduced, so that they can be upgraded
individually, therefore preventing headaches when installing the project locally, for either
verifying a bug, or contributing to it.
This change is a bit of a shift from the previous approach, but should allow for better stability,
and better dependency upgrade/checking, so that @dependabot patches breaking CI can be identified
more easily.
Ben Ramsey
Marco Pivetta