supress the .lock file

[renecotyfanboy]

Hi, I saw a bunch of Dependabot-triggered pull requests, and they are mostly linked to the .lock file. I am pretty sure this file is not needed in the ChainConsumer codebase as uv should be able to build a working environment in the CI on its own.
WDYT @Samreay ?

[Samreay]

Why remove the lock? If we want less noisy emails about dependency versions which dont matter (agreed) the dependabot is a github configured bot that I can (and have) turned off in the settings. It'd be good to keep the lock file as a record of a fully-resolving environment that worked, especially for any future development experience and replicating dev envs.

[renecotyfanboy]

It'd be good to keep the lock file as a record of a fully-resolving environment that worked

This seems to be a good argument. Let's keep it that way

[renecotyfanboy]

Just for the record, arviz is undergoing a major refactor with 1.0.0, I proof-tested ChainConsumer against it and it seemed to work from the user side. I was able to catch a bug that will occur in the test CI when Arviz bumps to 1.0 in the dev / CI environment, but this is an easy fix.