core: When using locked deps, still add the deps from zotonic.config

(cherry picked from commit e83297b8411306bacab7d083ea100844a53fa291)