Dependency freezing

[Alloyed]

Analogous to pip freeze.
Open questions:
Should there be a defined freezefile location that gets looked for, same as conf.lua?
In the case of scm rocks, should hashes be pinned? How would that be implemented?
Should a freezefile include repository info?
Should loverocks deps prefer a freezefile if one exists or should it get its own command (maybe even xargs loverocks install)?