pdm: Adds basic lock file invalidation

[purepani]

Basic idea for lock invalidation in pdm.
This would fix #999 but isn't exactly complete.
All this does is pull the hash from the lock file, and manually calculate the hash in the same way that pdm does. This isn't a great solution because any time pdm changes the way the lock file hash is calculated.
The alternatives are:

• Use runCommand on a script that makes pdm evaluate whether the lock file is valid or not. This seems a bit clunky to me.
• Use an external lock file to store lock file hashes. I think this is a better way to do it, but at least the way I'm imagining it, might require some work. In my head, the best solution would be a single dream.lock file, that would contain data for all hashes for all lock files for any given project; i.e., instead of the way that the pip and npm work, where they generate a full lock file on their own, we can generate the lock files for any given tool and store the invalidation hash instead.

I'd like to suggest the second solution since it could allow for easier usage of many package managers for a variety of language, but it's also a little involved.
@DavHau @phaer