Ensure vendored lockfile stays in sync with changes to gemspec/Gemfile/plugins/versions

There have been several changes recently which resulted in drift between the checked in lockfile and the actual spec defined by our gemspec, Gemfile.template, versions.yml etc.
- https://github.com/elastic/logstash/pull/19234
- https://github.com/elastic/logstash/pull/19233

During packaging and testing the lockfile is silently "repaired" such that the input spec are respected. We should come up with a strategy for detecting this drift and ensuring we take action. This could be a PR ci step in which we do a build and compare the generated lockfile with the one currently checked in and assert it matches. This would help us ensure that the vendored lockfile is accurately defining the gems that ship with logstash artifacts.

Start by reviewing the checked-in vendored lockfile alongside the gemspec, Gemfile.template, and versions.yml, then inspect how packaging and testing currently generate or repair the lockfile. Define a CI build-and-compare check; done means CI detects and rejects drift between the generated lockfile and the checked-in file.

Written by the indexing model from the issue text.