feat: rewrite install procedure

rewrites the installation of packages from scratch to solve several issues with
the existing implementation:

- does not need to choose between lockfile and jsonnetfile anymore. The
jsonnetfile what to be installed, while the lockfile also has versions and
checksums of all packages, even nested ones.
- the lockfile is regenerated on every run, preserving the locked values
- downloaded packages are hashed using sha256 to make sure we receive what we
expect. If files on the local disk are modified, they are downloaded again.

spec/spec.go

@@ -22,6 +22,7 @@ type Dependency struct {
 	Name      string `json:"name"`
 	Source    Source `json:"source"`
 	Version   string `json:"version"`
+	Sum       string `json:"sum,omitempty"`
 	DepSource string `json:"-"`
 }