feat: dependency locking

[ArjixWasTaken]

Resolves #7

[ArjixWasTaken]

This is quite a complicated PR, since it introduces an extra .ini file.
So I am refactoring the ini code to support multiple .ini files.

I haven't pushed a commit yet since it's not ready.

[ArjixWasTaken]

Ugh, it is disgusting hacking together complex .ini support in amber.
I think I'll start the Rust rewrite earlier than expected.

[Thesola10]

Since we already require jq as a hard dependency, why not just make the lockfile JSON?

[ArjixWasTaken]

Hmm, that could be done

[Thesola10]

Consider the following:

{
  "version": "1",
  "amber_version": "0.5.1-alpha",
  "dependencies": {
    "xylitol": {
      "type": "git",
      "url": "https://github.com/zlfn/xylitol.git",
      "ref": "b3e6d23bad93c9cb7997079dbd806ab2f0680594"
    }
  }
}

Contrary to Nix flakes we don't allow a parent project to override child dependencies, so we don't need a recursive format. Here the version field refers to the lockfile spec version, not the Amethyst version.