Support dotnet tool restore --locked-mode

[0x0309]

dotnet restore has --locked-mode for repeatable restores. The same kind of option should be available for dotnet tool to verify tool identity.

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[marcpopMSFT]

We have package source mapping support for restore and tools which is the recommended way of doing this. Tools don't need a lock file because the configuration manifest specifies the version and doesn't support transitive dependencies.

[KalleOlaviNiemitalo]

The same justification could be used for removing content hashes from NuGet package lock files. After all, the exact version is already specified there, and package source mapping together with repository signatures and HTTPS should ensure that the package is not tampered with.

Those cannot detect government coercion or other insider attacks at the package repository though. The content hash can detect those for previously resolved versions, although not for newly published versions.