--imgpkg-lock-output should tell user it only works with pushed images

**Describe the problem/challenge you have**
If a user tries to use the `--imgpkg-lock-output` flag without relocating the images, you'll get this cryptic error message:
```
kbld: Error: Validating images lock:
Expected ref to be in digest form, got 'kbld:simple-app-sha256-e5425420531e8f8dac8fa6acafc0f3f3a7f43603c5ff2be5b83c291ca9c1d9a0'
```

The problem is that the imgpkg lock file format needs a resolved image digest, which the local docker image storage cannot provide.

**Describe the solution you'd like**
A better error message is a start, maybe some documentation on the flag too.

```
$ kbld -f examples/simple-app-build-local/build.yml --imgpkg-lock-output foo.yaml

kbld: Error: --imgpkg-lock-output can only be used with images that have been pushed to a registry
```

**Anything else you would like to add:**
https://kubernetes.slack.com/archives/CH8KCCKA5/p1613491718286700