Support hashes in lockfiles

[ctheune]

Pip already automatically checks for hashes, but we don't generate them into the lockfile. Need to check whether we can do that