Nitrile can now use the lock file instead of the package file

What does this MR do?

This MR adds a CLI flag --locked to the nitrile command fetch, so the lock file (with exact versions) is used for fetching the dependencies instead of the first nonzero minor version specified in the package file (YAML)

Changes to public APIs

Author's checklist (required)

• A changelog entry has been added (guidelines)
• Newly added code is documented (guidelines)
• Newly added code has a style consistent with the rest of the repository
• Intermediate commits compile (use git rebase -i main if not)

Related issues

Closes #27 (closed)