Add flat-lock.json with checksum

[BSteffaniak]

To ensure that no packages have changed since they have been installed, airship install should create/update a flat-lock.json with each of the package's contents checksum. If the package's checksum differs from the checksum in the lock file, then error out of the install with a security error about the package's contents changing since the last installation.

• Should this handle backing up the existing installation?
  • Perhaps new installs are installed to a temp file name and then moved to the destination once checksum passes.

Manual checksum tar --exclude-vcs --exclude-from=.gitignore -cf - . | md5sum

Check the git SHA git rev-parse --verify HEAD