Lock Maven Dependencies by cryptographic hashes