Add composer-install & use in composer-test-mwextension
If something has composer.lock, then keep what is
installed at those versions, else this would install/update
with fresh dependencies.
For things like "Wikidata" extension, composer update
has already been run and this contains build results,
with composer.lock. In this case, we don't want to run
composer update again here, and want to test it as-is.