CSpell is not skipping composer.json and composer.lock, which will prevent committing dependency updates or tagging releases unless --no-verify is used

Problem/Motivation

In #2972224: Add .cspell.json to automate spellchecking in Drupal core we added automatic spellchecking to core, which is pretty cool. This exchange occurred in comments 36 through 37:

Should not the excluded path include more files/directories? As package.json and yarn.lock are excluded, should not composer.json and composer.lock be excluded too?

@kiamlaluno composer.lock is up a directory so not relevant. I think scanning the composer.json in /core is good. They have text in.

However, when I tried to commit #3153869: Remove leftover of wikimedia/composer-merge-plugin today, I got this:

Checking changed files...
CSPELL: checking all files
/Users/xjm/git/maintainer/composer.json:94:10 - Unknown word (phpcbf)
/Users/xjm/git/maintainer/composer.json:94:20 - Unknown word (phpcbf)
/Users/xjm/git/maintainer/composer.lock:21:18 - Unknown word (shasum)
/Users/xjm/git/maintainer/composer.lock:73:18 - Unknown word (shasum)
[...snip...]
CSpell: Files checked: 2, Issues found: 222 in 2 files

Proposed resolution

Fix whatever needs to be fixed to actually skip these files.

Remaining tasks

?

User interface changes

N/A

API changes

?

Data model changes

N/A

Release notes snippet

N/A