is there a recommended practice for how to handle tool lockfiles/resolves, project lockfile/resolves and plugin lockfile/resolves? there's multiple ways of doing it, and it's all quite confusing.