Warn on `pub get/upgrade` if pubspec.lock is not checked into vc and you are publish_to: none

[sigurdm]

Only if you are inside a vc (git) repo.

[sigurdm]

This would potentially make it harder to lose information

[stuartmorgan-g]

Depending on our tolerance for potentially noisy warnings, we could consider warning on pub get instead. Anecdotally, many of the people who don't know about pubspec.lock and best practices for it also don't ever run pub upgrade (and may well not know about it, and instead think that the way to update dependencies is to always just edit puspec.yaml).