locking of transitive dependencies

Finally opening this for discussion. I dared to completely leave out all the informational data from the lock file, and propose to add it separately. It could be generated simply using the dependencyReport task, defined by the project-report plugin, and copied to the project root.