"kpm bundle --no-source" should add generated packages to project.lock.json

[ChengTian]

Should be based on @lodejard 's work on lock file.

kpm bundle --no-source generates packages from dependency projects. When locked is true in project.lock.json, we should add the generated packages to project.lock.json, to make sure they can be picked up during dependency walking.

[davidfowl]

As part of this work we're going to need to delete the global.json dependencies logic.