I understand that `composer.lock` is meant to pin down the exact version of the installed dependencies. But what purpose does the `vendor/composer/installed.json` file play?

Both contain JSON and both are generated automatically.