Specify versions in cpanfile and add a lockfile

[curiousdannii]

Unversioned dependencies doesn't let us reliably set up a server, either for local testing or production. The cpanfile should have versions for every package, and a lockfile should also be used.