Be more strict with compatibility rules in lock file

[jvolkman]

Two issues:

1. Today if a package is compatible with all configured platforms, no select is generated which provides no way to prevent some other incompatible platform from using it. Instead, these packages should be limited to all configured platforms.
2. Generated selects should default to @platforms//:incompatible