Prevent composer.lock file

As this is a package/library, not a project.
We do not want any specific state.

We therefore also should use `composer update` instead of `composer
install`.

composer.json

@@ -53,6 +53,7 @@
     },
     "config": {
         "sort-packages": true,
+        "lock": false,
         "allow-plugins": {
             "typo3/cms-composer-installers": true,
             "typo3/class-alias-loader": true,

shell.nix

@@ -10,7 +10,7 @@ let
       composer
     ];
     text = ''
-      composer install --prefer-dist --no-progress --working-dir="$PROJECT_ROOT"
+      composer update --prefer-dist --no-progress --working-dir="$PROJECT_ROOT"
     '';
   };
   projectValidateComposer = pkgs.writeShellApplication {