composer.phar composer.lock vendor/ installer