Dedicated lock file support

[guybedford]

Opening to track a dedicated lock file feature, for when the time comes that this is needed.

There may still be some benefits maintaining a dedicated lockfile:

• The importmap.json no longer gets shoved into this role, which may cause confusion about what that file is when it is in situations playing the role of a lockfile from which individual mappings are extracted
• Trace integrity
• env no longer needs to be tracked in the import map
• Additional metadata can be retained, such as the provider scoping
• No handling is needed for residual deconstruction, and we avoid deconstruction lossy cases like trailing paths (although these cases should still be fixed)

The main thing is to just work this out from a usability perspective, and ensure it fits into workflows, both CLI-based and running as an API.

That is, we should only implement this when it is really needed and we have not yet reached that point for now.