Pin to specific version of Lightning

[balsama]

The 2.2.1 update of Lightning is proving to be a larger problem for Headless than anticipated. Generally, we assume that since Lightning has a stable update path, consuming packages should be able to seamlessly update too, but that wasn't the case with 2.2.1 even though the tests within Lightning and our canary apps passed.

Since Headless doesn't pin to a release, users of Headless who updated before we fixed the update path here could have broken builds. To mitigate this, I propose that we ping Headless to a specific version of Lightning and take on the maintenance of making a new release of Headless when Lightning releases. This is our unofficial policy already.