It might not just be for providers, and it's in the plugins dir, so lock.json seems descriptive enough.
This is just a JSON file with the SHA256 digests of the plugin executables.