Add ability to update lockfile without updating poprox-concepts (#58)

This PR adds a `--freeze-concepts` option to `update-dep-lock.sh` to
allow us to update the lock file (e.g. to add a new dependency)
**without** also updating the version of `poprox-concepts` in use. This
is useful to allow development of things that need new dependencies
while someone else is working on updating the recommender to a new
`poprox-concepts` version.

Adding the reverse — updating only `poprox-concepts` without other
dependencies — is still blocking on conda/conda-lock#652.