fix: check for valid lockedVersion

When pinning, check that the “version” in a lock file is a valid semver, and ignore it if not.