Always remove the composer.lock file when running composer

We normally run without a composer.lock file when building, but while
updating from local sources (e.g. in non-production test environments),
the lock file can be incompatible with changes causing composer update
to fail.