Use `opam lock` to lock dependencies

I ran opam lock to produce this ligo.opam.locked file.

When someone uses ./scripts/install_vendor_deps.sh or make now, it should pick up this locked file so that we get the same versions of dependencies. (Assuming there was no upstream in-place update... Would be nice if opam lock commits to a hash someday.)

Of course, this does not affect the versions chosen by the nix build...

opam install --help says about --locked:

Note that this option doesn't generally affect already pinned packages.

Not sure if that matters for us.