[Request] Pin/lock versions of specified plugins and all sub-dependencies

I would like the Plugin Installation Manager Tool to be able to pin/lock the versions of all the plugins given on the command-line or in a file as well as their sub-dependencies. This behavior would imitate the locking functionality of tools like [Bundler](https://bundler.io/guides/using_bundler_in_applications.html), [Gradle](https://docs.gradle.org/current/userguide/dependency_locking.html), and [Yarn](https://classic.yarnpkg.com/en/docs/dependencies/).

One major benefit of locking all plugin versions is that the Jenkins configuration becomes 100% reproducible. Another benefit is that security scanning of all plugins and sub-dependencies becomes possible. Here is an example of what this pinning/locking might look like in a CI pipeline:

```bash
# Input file.
cat <<"EOF" >plugins.txt
blueocean:1.21.0
junit:latest
EOF
# Lock all plugins and sub-dependencies from specs in plugins.txt and output to plugins.yml.
java -jar plugin-management-cli.jar --lock-file plugins.yml --plugin-file plugins.txt
# View security warnings for all locked plugins and sub-dependencies.
java -jar plugin-management-cli.jar --no-download --plugin-file plugins.yml --view-security-warnings
```

The output YAML file would contain all the plugins from the input file and their sub-dependencies locked to specific versions:

```yaml
plugins:
- artifactId: blueocean
source:
version: 1.21.0
# All of blueocean:1.21.0's sub-dependencies would be locked here.
- artifactId: junit
source:
version: 1.28 # This is the latest version of the junit plugin at time of writing.
# All of junit:1.28's sub-dependencies would be locked here.
```