Previously our composer package cache would not be updated because we
had no `composer.lock` (which hash is used as part of the cache key).
Generating `composer.lock` (but not installing packages) before we check
the cache fixes this.
There were a number of test failures caused by setup-php failing to
install the required PHP version. While we certainly should fix our
failing tests, we also need to be sure which PHP version we're using.
This PR does exactly that.
