As "composer.lock" was not versioned the dependencies had to be resolved
everytime that the acceptance tests run, which took some precious time.

Besides that the dependency versions were also tightened for better
control.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>