Graduate lockfile from experimental to stable

[brooke-hamilton]

This pull request graduates the lockfile feature from experimental to stable. Lockfiles are now generated by default during build and up commands to ensure reproducible builds. New CLI flags (--no-lockfile and --frozen-lockfile) are introduced for more explicit control, while the old experimental flags are deprecated but still accepted with warnings.

Lockfile Feature Graduation and CLI Changes:

• Lockfiles (.devcontainer-lock.json) are now generated by default on build and up, pinning feature versions for reproducibility. [1] [2]
• Added new CLI flags: --no-lockfile (disables lockfile generation/verification) and --frozen-lockfile (enforces lockfile existence and immutability). Deprecated --experimental-lockfile and --experimental-frozen-lockfile with warnings. [1] [2] [3] [4] [5] [6]
• Enforced mutual exclusivity between lockfile-related flags at the CLI layer, throwing errors for invalid combinations. [1] [2]

Documentation and Tooling:

• Updated README.md and CHANGELOG.md to reflect lockfile graduation and new CLI behavior. [1] [2]
• Improved test instructions in docs/contributing-code.md to clarify packaging requirements before running tests.
• Added the Mocha test adapter extension to the devcontainer for better test integration in VS Code.
• Added a new test config for lockfile opt-out.

This PR closes issue #1195
There are no spec changes in this PR, but there is a related proposal at devcontainers/spec#727