Now that we have package-log.json for the sake of reproducible builds, we should lock CocoaPods as well.