Reviving the dependency pinning topic

[hazy sedge]

At this point I'm assuming we'll need pinning beyond Buildkit's built-in source pinning. Wolfi for example would likely involve locking the result of an apko show-packages call which then feeds into the actual build.