[dune-pkg] Relocking files with `dune build`

[maiste]

Following the discussion during the Dune Dev Meeting (cf notes), there was the discussion about re-locking the file with dune build and dune build --watch. The retain solution was:

• dune build would print an error message when it is run, and it detects the dependencies have changed. The message would ask the user to re-run dune pkg lock. The user could then re-run dune build and the error about the dependency must be gone.
• dune build --watch would pause and display a message asking for the user to run the `dune pkg lock. Once it is done, it would unpause automatically as the watch mode would detect the dependencies have changed. Thus, it would recompute the dependency graph and re-build what needs to be re-built. This would be done by checking the dependency hash and check when it changes.

This solution is a compromise between auto-locking and full manual locking, as it would prevent the user to have their dependencies updated without noticing.

There are some questions left here:

• Should we add a config flag to have this as an experimental feature, or should it automatically detect the lock file and be available without it?
• Is there a way in the current behavior of Dune to ""pause"" the watch mode?
• @rgrinberg, you mentioned the fact that people could hard-code the opam commit in their workspace file, and we could take it into account when rebuilding. Is this something we want to consider here, or should we exclude this for now? IIUC, running dune pkg lock will ~opam update our package set: do we want to warn the user if the commit is hard-coded?