Use composer install instead of composer update

The former respects `composer.lock` files if they exist, as is
recommended by https://getcomposer.org/doc/01-basic-usage.md#commit-your-composer-lock-file-to-version-control,
and is the command given in installation instructions, e.g.
https://www.mediawiki.org/wiki/Extension:TemplateStyles

Add the composer.lock for Patch demo itself.

Author: edg2s

.gitignore

@@ -2,6 +2,5 @@ config.php
 wikis
 repositories
 composer
-composer.lock
 vendor
 node_modules