Add --locked flag for several subcommands

[kylewlacy]

This PR updates several subcommands with a new --locked flag, namely build, check, run, and install. When used, the command will fail unless the lockfiles are up-to-date.

The main motivation for this change is for use in CI, such as in the brioche-packages repo (see brioche-dev/brioche-packages#111 for an example of a PR that got through with an out-of-date lockfile)

Currently, the error messages leave a lot to be desired... here's an example error:

Error occurred with project './packages/hello_world': project load errors: [FailedToLoadDependency { name: "std", cause: "hash for download 'https://example.com/' not found in lockfile" }]