Add support for Pipenv by cataloging packages found in the Pipfile.lock.

(note: this is work being broken off from anchore/grype#29)