fix: convert the lockfile path to a repo-root-relative path before use (#5958)
When calculating scope, we used an absolute path instead of a repo-relative path meaning that globs would fail. This resolves that. It additionally makes more-clear a constraint that we have that lockfiles must be within
a repo to support change detection, and adds error handling / tests for that.
It also removes the use of wax (globbing) from the initial impl, which was ported across verbatim from go, since I believe we are just comparing resolved paths at this point.
Co-authored-by: Alexander Lyon <Alexander Lyon>