Should one use a lock file in a JSR library or not? If not, should one put it in `.gitignore` or rather set `lock: false` in `deno.json`?