Do not write the lockfile if there are no dependencies
Just check for a starting curly brace for legacy lockfiles

Turns out - Seth is bad at regular expressions. Instead of this complex
regular expression, let's just check if the first character is a `{` to
detect if the lockfile is an old format.
Delegate Dependency#to_lock to location objects (when present)
Add == checks to locations
Don't trust the lockfile if the dependency's location has changed