option to lock all tool dependencies

[houbie]

This PDM issue showed that even released versions of python tools can be broken by downstream dependency releases.
To really make sure that builds won't break, we need to lock all (recursive) dependencies.

Proposed solution:

• use pip freeze to lock all packages in a tool context
• store the result of pip freeze in pw.lock
• add a --lock CLI option
• always check if the lock file is up-to-date
• modify the hash key generation for checking requirements changes: sort requirements before calculation