Use PHPUnit that is provided by composer instead of the PHAR

Specify an exact version of PHPUnit.  Autoload test classes if developing.

build.xml

@@ -33,22 +33,8 @@
     </target>
 
     <!-- Runs PHPUnit -->
-    <target name="test" depends="get-phpunit">
-        <exec command="php phpunit.phar" passthru="true" checkreturn="true"/>
-    </target>
-
-    <!-- Downloads PHPUnit -->
-    <target name="get-phpunit">
-        <if>
-            <not>
-                <available file="phpunit.phar"/>
-            </not>
-            <then>
-                <httpget dir="${project.basedir}"
-                         url="https://phar.phpunit.de/phpunit.phar"
-                         followRedirects="true"/>
-            </then>
-        </if>
+    <target name="test">
+        <exec command="php vendor/bin/phpunit" passthru="true" checkreturn="true"/>
     </target>
 
     <target name="release">

composer.json

@@ -15,11 +15,16 @@
     "source": "https://git.doit.wisc.edu/adi-ia/uw-php-security"
   },
   "require-dev": {
-    "phpunit/phpunit": "^5.4"
+    "phpunit/phpunit": "5.7.2"
   },
   "autoload": {
     "psr-4": {
       "edu\\wisc\\doit\\uwphps\\": "src/main/edu/wisc/doit/uwphps"
     }
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "edu\\wisc\\doit\\uwphps\\": "src/test/edu/wisc/doit/uwphps"
+    }
   }
 }

composer.lock

@@ -4,8 +4,8 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
         "This file is @generated automatically"
     ],
-    "hash": "fdb4b179138092bf5b2be9eb78ca9bd2",
-    "content-hash": "609c5126a4bee0ed8969f6915e8f5ee3",
+    "hash": "8f6e29a0b7f012c3a62df9e5899d57d3",
+    "content-hash": "9e664849ddf46e1a2b66fd5185bf57b8",
     "packages": [],
     "packages-dev": [
         {