Make `Pipfile.lock` mandatory when using Pipenv

[edmorley]

Using Pipenv without a lockfile can result in nondeterministic package installs, and so for some years if Pipfile.lock is missing we've emitted a recommendation in the build log to add it.

In addition, Pipenv has also since deprecated the --skip-lockfile feature upstream.

As such, we'd like to sunset support for using Pipenv without a lockfile.

A deprecation warning has been added in #1695 - once that has been showing for a bit we can then make Pipfile.lock mandatory when using Pipenv.

GUS-W-17308738.