Figure out idiomatic way to handle requirements.lock

[ljnelson]

requirements.lock and requirements.yaml are primitive versions of something like Maven's dependency management mechanism. We could port requirements.lock functionality over literally, but there are also various issues open against it in the Helm codebase suggesting that perhaps it's more fragile than we'd like at the moment.