Use composer install in the Psalm job

Our policy states that we do not want a new release to suddenly affect
our builds.

.github/workflows/continuous-integration.yml

@@ -23,11 +23,11 @@ jobs:
         uses: "actions/cache@v1.0.3"
         with:
           path: "~/.composer/cache"
-          key: "composer-${{ hashFiles('composer.json') }}"
+          key: "composer-${{ hashFiles('composer.lock') }}"
           restore-keys: "composer-"
 
       - name: "Install dependencies with composer"
-        run: "composer update --no-interaction --no-progress --no-suggest"
+        run: "composer install --no-interaction --no-progress --no-suggest"
 
       - name: Psalm
         run: "vendor/bin/psalm"