[Analyzer][Resolver] Implement more complete dependency locking

This should now behave more like Bundler

https://github.com/CocoaPods/CocoaPods/issues/2318, https://github.com/CocoaPods/CocoaPods/issues/2506

\c @alloy, @mrackwitz, @kylef 
My comment is now obviously wrong, because you inverted the locking.