Enforce consistency between test + release dependencies

[cjfuller]

Right now we resolve test-only dependencies completely separately from the release dependencies and then include both on the classpath when running tests. In practice this often works out fine, but we should instead resolve test + release dependencies at the same time and error if we resolve anything to a different version than what's in the release lockfile.