Ability to promote freeze files to lock files

**Describe the feature request**

Currently, `cabal freeze` creates a file full of build constraints. These build constraints must be respected, but dependencies outside of these constraints can also be built (see example below).

### Example

Consider the following cabal file:

```cabal
executable myexe
build-depends: base, containers
```

Executing `cabal freeze` would generate a file like so:

```txt
active-repositories: hackage.haskell.org:merge
constraints: any.base ==4.20.0.0,
any.containers ==0.7,
index-state: ...
```

If I go ahead and modify my cabal file, e.g. to add a dependency on `text`:

```cabal
executable myexe
build-depends: base, containers, text
```

My project will still build, even if `text` isn't part of `cabal.project.freeze`.

My requested feature is to have a lock file, which would be almost identical to a freeze file, with the additional requirement that no dependencies without constraints may be used. In practice, this could be something like having a flag in `cabal.project.freeze` to specify whether constraints are exhaustive or not, instead of a whole new mechanism that parallels freeze files.

I am happy to work on implementing this feature!

## Additional context

At work, we're currently using `stack` and its lockfile support to restrict dependencies to approved packages. We work in a tighly regulated industry, where all dependencies must be audited.

Before switching to use `cabal`, we want to have assurances that `cabal` will not pull in additional dependencies.