Locking wit packages and specifying their dependencies

[macovedj]

I think a good logical first step for addressing lock files is having wasm-pkg.lock or wkg.lock for wit packages. Also it would be nice if the wit cli lived in wasm-pkg-tools.

In discussing this with a few folks, I think it might be worth considering having version requirements determined from the actual contents of the import/include/use statements in wit packages themselves, rather than something like wit.toml as the wit cli does today. The idea here is that errors may be avoided if tools look at a .toml in some places and look in binaries for others. Also current tools are prone to errors if artifacts are published with incorrect versions in their contents that don't match the version being published. While validations at publish time are one solution to this, I think generally we can reduce errors by doing things this way. There's also the added benefit of reducing the number of files.

After deciding whether there should be a .toml for specifying version reqs like today, or whether we want reqs to come from wit package contents, we could probably get started on having wkg support building wit packages across registry packages.