Always include lockfile in cache key

[ds300]

The user's lockfile should always be included in every cache key, unless we start doing static analysis of tasks to find out which packages they use like a big boy build system (Let's not do that 😓)

We can add an unsafe option to the CacheConfig type to turn off this behaviour on a per-script basis, maybe unsafe_excludeLockfile

Note that the lockfile path can be configured in yarn. Doesn't look like that's the case with npm/pnpm.