Standard for lock files in repos -- workspaces and modules

[greenkiwi]

We need to define a standard for when we do and don't need to have terraform lock files checked into our repos.

Our repos have two sets of directories that contain terraform code:

• workspaces -- locations that have config that is applied to an environment
• modules -- config that can be included in a workspace

We need to have an appropriate gitignore files.