difference between composer.json and composer.lock file