I'm starting to use Symfony Flex to bootstrap my project and I realized that running composer install for the first time generates a file named symfony.lock for which I could find no documentation.
What does this file do? Should I keep it in my version control and deploy it or should I .gitignore it?
Yes, officially you must add it to the version control:
Flex keeps tracks of the recipes it installed in the
symfony.lockfile, which must be committed to your code repository. https://symfony.com/doc/3.4/setup/flex#how-does-flex-work
Otherwise on staging or production stages it will be generated again by Flex, auto-configuring all installed packages with recipes and triggering bugs like this https://github.com/symfony/flex/issues/192