Add multi-hash lockfile support

[braydonf]

This will provide a means to specify the specific hash of a dependency, in the case that node_modules are not mirrored and committed into the git repository. The hash can be the commit hash in addition to a tree hash using a variety of algos, such as sha512. This will require the ability to reference a dependency by commit hash, such that if a branch is used instead of a tag, it will be possible to retrieve an earlier version if the branch head moves to another commit than was used previously.