Adds logic to support updating the accompanying `composer.lock` file whenever `composer.json` is updated.

Closes #2098 

Rewrite of dependency extraction, particularly for npm. Paves way for easier addition of new package managers.

Closes #1882