Previously even when installing dependencies from a lockfile,
jsonnet-bundler would attempt to resolve versions of transitive
dependencies to their latest floating version. Instead when a lock-file
is specified jsonnet-bundler should just install the specified versions.