this ensures that the same composer version is used by everyone (and ci)

Signed-off-by: Robin Appelman <robin@icewind.nl>