committing pubspec.lock file to track current dependencies

which is fine since this is an app, not a library