Do not build extra dependencies out of carton.lock. Fix #63

Even in the deployment mode, do not build deps out of .lock. Just do
so out of cpanfile, then using .lock to create 02packages mirror
definition without cascading.

This is a big behavior change, but this is more correct in terms of
what carton should do in the deployment mode.

There's still a tree building code for `carton tree` command which
should be rewritten in the same way.