Lock file validation

[davidfowl]

Without automatic restore, we might find ourselves in a situation where project.json has been changed but kpm restore wasn't run to generate a new lock file. In these situations, we should fail/warn the user that they need to regenerated the lock file.

/cc @lodejard @ChengTian

[davidfowl]

@ChengTian Does this affect kpm bundle? Does the lock file become invalid when you bundle?