we should not provide one in the package but developers should commit
them when starting a new project so that all share the same versions
and only explicit composer update command will change that.
Escpecially important when deploying to production.

Removed composer.lock from all apps. Currently it creates more problems since framework code changes rapidly.

https://github.com/yiisoft/yii2/commit/a6c251d2ab6d222b5318cc7fa21eb3791a296c62#commitcomment-3291785

git ignore composer.lock