Improve lockfile handling

[chris-rock]

Description

At this time, the lockfile is only generated when we use inspec vendor. We need to improve and simplify the handling for users:

Is the lock file is generated all the time?

• we always create a lock-file
• make it visible in our CLI output with profile location, eg “loaded from cache [cachedir]"
• create a lock file separately for each target

Are lockfiles generated for remote profile

• we do not create a lock file for remote profiles

lockfile + cache available

• use information from lockfile
• no remote connectivity required if we have everything in cache

lockfile + profile not available in cache and not downloadable

• display error, no further execution possible

Related to #888