Add Juvix package lockfile support

[paulcadman]

After support for external dependencies #2272 we need to add support for a package dependency lockfile

A lockfile is generated from the package file during the compile pipeline. It contains all the information required to reproduce the full dependency source tree.

In other words is walks through the dependency tree and records the immutable version associated with each dependency spec.

If it exists, the juvix compiler uses the lockfile to resolve dependencies instead of using the dependencies specs in the juvix package file.

Example:

package A

name: A
dependencies:
  - .juvix-build/stdlib
  - git:
      url: https://my.dep1.b
      name: B
      ref: v1.0.0
version: 0.1.0

package B

name: B
dependencies:
  - .juvix-build/stdlib
  - git:
      url: https://my.dep1.c
      name: C
      ref: v2,0,0
version: 1.0.0

package C

name: C
version: 2.0.0

A lockfile for package A (format to be determined)

dependencies:
    - .juvix-build/stdlib
    -  git:
          url: https://my.dep1.c
          ref: commit-hash-b
          name: B
          dependencies:
              - .juvix-build/stdlib
              -  git:
                    url: https://my.dep1.c
                    ref: commit-hash-c
                    name: C
                    dependencies: []

NB: The tag refs (v1.0.0) are resolved to immutable git hashes in the lockfile.

[paulcadman]

Closed by #2388