Suricata

This locks the version of our direct dependencies as well as transitive dependencies.

Need to consider the library case. Here it is (was?) generally considered bad practice to ship a lock file.