version pinning via a lock-file

[jan-xyz]

Right now, if you manage multiple machines they tend to drift and ecosystems you don't use often will fall behind and will not stay up-to-date. The idea is to write the installed versions into a lock-file and track these as well and make it also machine readable for automatic version bumping support.
e.g.

dotfiles install

should read versions from the lock-file and try to install these

dotfiles update

should update the packages and write the new versions into the lock-file

dotfiles pin

should query the different ecosystems and write the installed versions to the lock-file