Hopefully fix composer package compatibility ..?

struggling to get this all straight it seems..

Hopefully fix composer-components path issue ?

fannie/src/javascript/composer-components was not getting the
necessary files, and i noticed the upstream composer.json used a
different config style for mapping these paths. so copied that
snippet and hoping this works...

not clear why i would not have noticed that mapping before, or why i
ignored if so..?

Update composer lock per upstream changes

result of `composer update`

in particular, mailchimp/marketing was needed..but several other
things seem to have been added/changed as well..?

Update composer dependencies, per change in CORE

cf. https://github.com/CORE-POS/IS4C/pull/1186