feat: rewrite install procedure

rewrites the installation of packages from scratch to solve several issues with
the existing implementation:

- does not need to choose between lockfile and jsonnetfile anymore. The
jsonnetfile what to be installed, while the lockfile also has versions and
checksums of all packages, even nested ones.
- the lockfile is regenerated on every run, preserving the locked values
- downloaded packages are hashed using sha256 to make sure we receive what we
expect. If files on the local disk are modified, they are downloaded again.

pkg/jsonnetfile/jsonnetfile.go

@@ -60,7 +60,7 @@ func Load(filepath string) (spec.JsonnetFile, error) {
 
 	bytes, err := ioutil.ReadFile(filepath)
 	if err != nil {
-		return m, errors.Wrap(err, "failed to read file")
+		return m, err
 	}
 
 	if err := json.Unmarshal(bytes, &m); err != nil {