Populate `pin-depends` only with the packages that needs to be pinned in the switch

[samoht]

This is a tentative fix for https://github.com/mirage/mirage/issues/1476

I guess we could want to add the switch pins to that pin-depends field for reproducibility.

[samoht]

This is ready to review.

This is a breaking change:

• currently, pin-depends of the locked file contains the complete list of vendored packages. The rationale is to be able to opam install <pkg>.opam.locked to get something similar to opam monorepo pull. It was a great initial goal. Still, nowadays, with the distinction between switch local and vendored directories (and the ?vendor variable), I am not sure this is still very consistent.
• so instead, this PR populates pin-depends with the list of packages to be pinned in the current switch. The rationale is to make sure opam install <pkg>.opam.locked will install the required dependencies for the existing switch. If there is a x-opam-monorepo-repositories field, we skip the locally pinned packages, otherwise, we record them in the locked file.

Note that I am still a bit confused with the expected workflow to use when using x-opam-monorepo-provided. Maybe we do not need all of this, but unless I'm mistaken, I don't see how support for pinned packages in the switch is working today.