Track the lock file?

@JGuetschow had an issue where his local xarray version was different to what was being used in CI. Is it worth tracking the lock file so that all devs and at least one CI step use exactly the same environment? The other CI steps can then test different environments as needed (lowest supported, latest etc.).