Ignore composer.lock

Having a big composer.lock on a final project can have side effect on incoming PR that add a new vendor.
Mostly because conflict are too frequent.

By ignoring composer.lock we ease the PR submission and rebase.

BUT we need to be careful when we release a new version of wallabag. We should manually `git add -f composer.lock` to update it.

Since composer.lock will no longer be commited I switch the `composer install` to a `composer up` in the travis configuration.