Add feature for vendoring transitive dependencies when a lockfile exists