Add lockfile

It would be nice to have a lockfile for each bundle that describes the resolved versions for that bundle. We could generate it on the first run and then use it on subsequent runs to lookup which version of a dependency to use.

Side note: This may also help us to determine when more than one version of a dependency is being used in the same bundle.