Add a lock command

This patch builds on #2476 to add a standalone `bundle lock` command to generate Gemfile.lock.  I've kept this as a separate branch because it changes the specs, so might be a little more contentious.