Dependency lockfiles for reproducible build environments

 Tracks a description of a desired state in *repro-env.toml*, for example, the
 latest version of some official container image, with the latest patch level
 and the latest version of some additional packages.
 It also tracks a resolved variant in *repro-env.lock* that tracks the
 specific versions and checksums of the packages needed to set up the described
 environment (at the patch-level available at the time of writing).
 .
 The purpose of *repro-env.toml* is to make it trivial to re-resolve the
 specification if new patches become available. This file is read by *repro-
 env update*.
 .
 The purpose of *repro-env.lock* is to document which compiler versions have
 been used for the release binary associated with a given release. Recording
 this information is essential for reproducible builds and allows future
 forensic investigation of the build environment. It can be either committed
 into the source-code repository or attached to a release as an artifact, along
 with the compiled binary. This file is read by *repro-env build*.