Stop committing composer.lock, resolve dependencies per CI matrix entry

The lock was resolved on PHP 8.4 (symfony/serializer 7.4 requires PHP >= 8.2),
which broke 'composer install' on the PHP 8.1 matrix job. Libraries should
not pin a lock: the phpunit workflow now runs 'composer update' so each
matrix PHP version resolves its own compatible dependency set
(8.1 -> serializer 6.4, 8.4 -> serializer 8.x). Cache key moved to
composer.json accordingly.

Note: the 'PHP Linting' workflow failure is pre-existing (since Jan 2026):
.php-cs-fixer.php-highest.php aborts unless it runs on PHP 8.1 while the
php-cs-fixer-ga docker image has moved to a newer PHP. Left for a
dedicated maintenance pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Florian Guimier

.github/workflows/phpunit.yml

@@ -21,11 +21,11 @@ jobs:
         uses: actions/cache@v3
         with:
           path: vendor
-          key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
+          key: ${{ runner.os }}-php-${{ hashFiles('**/composer.json') }}
           restore-keys: |
             ${{ runner.os }}-php-
       - name: Install Dependencies
         run: |
-          composer install
+          composer update --no-interaction
       - name: Execute PHPUnit tests
         run: vendor/bin/phpunit

.gitignore

@@ -3,4 +3,4 @@
 .php_cs.cache
 .php-cs-fixer.cache
 .phpunit.result.cache
-test.php
+test.phpcomposer.lock