lockfile

[jdx]

Here's what we can do with a lockfile:

1. we can make rtx local --fuzzy the default behavior (since the real version will be locked) which is probably what people expect
2. we can set the plugin repositories so other developers doing need to manually install plugins that either aren't in the shortname repo or are supposed to use a custom location
3. we could have an rtx upgrade command to update the lockfile to the latest matching version

People have asked about having a custom shortname repo, but I think number 2 here actually makes that unnecessary.

This was mentioned in this thread, although I am not sure that locking to a specific plugin commit sha makes sense:

• https://github.com/asdf-vm/asdf/issues/523#issuecomment-825312176