always resolve dependencies

at present if there's a lockfile all the dependencies from it are
returned, which blows at least :except (and probably :only) out of the
water. Now we'll try and use locked versions, but only after resolving
the groups we want.
test that --except works with a lock file
remove lockfile sha support across the board
clobber extraneous newline
Lockfile#update no longer needs an options arg
update comment on locking algorithm
fix up whitespace a touch
Merge pull request #694 from thommay/make_except_work

always resolve dependencies