add support for -r, -a, and -t

-r: recursively grab dependencies

-a: flatten (aggregate) dependencies into one parent .lock

-t: trickle dependency versions from the root-level .lock down into deeper
dependency's Cartridge.locks