Caching composer in Actions, keyed on the lock file

Downloading eighty packages on every push is thirty seconds of every build, and the fix is a cache keyed on the thing that determines the contents.

- id: composer-cache
  run: echo "::set-output name=dir::$(composer config cache-files-dir)"

- uses: actions/cache@v2
  with:
    path: ${{ steps.composer-cache.outputs.dir }}
    key: composer-${{ hashFiles('**/composer.lock') }}
    restore-keys: composer-

Caching the download directory rather than vendor/ is the important choice: a stale vendor/ silently ships the wrong versions, and a stale download cache costs nothing because Composer still resolves from the lock file. restore-keys gives a partial hit when the lock changes, so a one-package update does not start cold. Note that a cache written on a branch is not readable from another branch unless it was written on the default one, which is why the first build after a merge is slow.