feature request: have an option to create vendor tarballs with locked versions

[jubalh]

It would be useful to have an option to create vendor tarballs with locked versions, so that in such cases we don't have to create the tarball ourselves. For context: https://github.com/ast-grep/ast-grep/issues/1118