[Feature] Avoid unnecessary `package-lock.yml` regeneration for git packages with environment variables

### Is this a new bug in dbt-core?

- [x] I believe this is a new bug in dbt-core
- [x] I have searched the existing issues, and I could not find an existing issue for this bug

### Current Behavior

When using [environment variables in git package URLs](https://docs.getdbt.com/docs/build/packages#git-token-method) (for authentication or environment-specific configurations), `dbt deps` generates different package hashes on different machines even when the actual package specification is identical. This causes several problematic behaviors:

Unnecessary lockfile regeneration: `package-lock.yml` constantly changes across different environments
CI/CD noise: Build logs filled with "Regenerating lock file" warnings
Version increment confusion: Teams may accidentally increment package versions when lockfiles change unexpectedly
Workflow friction: Developers see meaningless lockfile changes that don't represent actual package updates
Example scenario causing the bug:
Developer A (with `SECRET_GIT_TOKEN=abc123`):

Generated hash: `9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b`
Developer B (with `SECRET_GIT_TOKEN=xyz789`):

Generated hash: `1f2e3d4c5b6a7980fedcba9876543210abcdef12` ❌ Different hash!

Result: `package-lock.yml` shows different hashes, causing git diff noise and potential confusion about whether packages actually changed.

### Expected Behavior

Git packages using environment variables for credentials or environment-specific values should generate consistent hashes across different machines when the actual package specification (repo, revision, etc.) remains the same.

Both developers should get the same hash.

### Steps To Reproduce

Create a `packages.yml` with a git package using environment variables:

Set environment variable: `export GIT_TOKEN=token123`

Run `dbt deps`

`package-lock.yml`

Change environment variable: `export GIT_TOKEN=differenttoken456`

Run `dbt deps`

Bug: Observe that the hash in `package-lock.yml` has changed even though the package specification is functionally identical

### Relevant log output

Here is a packages.yml that uses an env var:
```
packages:
- package: dbt-labs/dbt_utils
version: 1.3.0
- git: "https://{{ env_var('DBT_ENV_SECRET_GIT_CREDENTIAL')}}@github.com/myrepo.git"
revision: [revsion_hash]
```

Because different users will have different env vars set, their hashes will not match, or match prod. Package locking cannot really be done locally since other users will never respect the lock.

### Environment

```markdown
OS: macOS/Linux/Windows (affects all)
Python: 3.8+
dbt: 1.8+ (likely affects earlier versions)
```

### Which database adapter are you using with dbt?

snowflake

### Additional Context

Relates to https://github.com/dbt-labs/dbt-core/issues/10913