Lock the cordova-tarball-plugins.json