security: Improve trust model with plugin authors by controlling executed code

Currently vim-plug doesn't appear to have a well supported means of controlling what source code is included+executed when vim starts up since the latest content is pulled in by default.

I think we should implement lockfile system for the following reasons:

1. Reproducible environments across machines
3. Prevention of unexpected plugin updates
4. Easier rollbacks to known-good states

The current snapshot feature, while useful, has limitations:

- Slow startup times due to executing multiple git commands on each Vim launch
- Doesn't prevent automatic updates during normal plugin operations

A lockfile approach would:

- Store plugin commit hashes in a simple, fast-to-read format
- Be checked during updates to determine if changes are needed
- Only update plugins when explicitly requested or when the lockfile changes
- Significantly reduce startup overhead compared to the current snapshot system

This feature would enhance vim-plug's utility for users prioritizing stability, reproducibility, and performance in their Vim/Neovim setups.

- Type:
- [ ] Bug
- [ ] Enhancement
- [x] Feature Request
- [ ] Question
- OS:
- [x] All/Other
- Vim:
- [x] Terminal Vim
- [x] GVim
- [x] Neovim