add maven-lockfile (#1368)

* add maven-lockfile

Signed-off-by: Martin Monperrus <martin.monperrus@gnieh.org>

* Update securing-build-pipelines.md

Signed-off-by: Martin Monperrus <martin.monperrus@gnieh.org>

---------

Signed-off-by: Martin Monperrus <martin.monperrus@gnieh.org>
Co-authored-by: Brandt Keller <43887158+brandtkeller@users.noreply.github.com>

Author: monperrus

community/publications/supply-chain-security-tools/securing-build-pipelines.md

@@ -17,7 +17,6 @@ Here are the list of requirements for securing build pipelines. Each one has a l
 - SLSA (level 1)
 - in-toto
 
-
 ## 2. Validate environments and dependencies before usage
 
 ### Tool capability
@@ -69,6 +68,7 @@ Here are the list of requirements for securing build pipelines. Each one has a l
 ### Tools
 
 - apko
+- [maven-lockfile](https://github.com/chains-project/maven-lockfile/) for Java/Maven
 
 ## 6. Find and Eliminate Sources Of Non-Determinism
 
@@ -162,7 +162,7 @@ Here are the list of requirements for securing build pipelines. Each one has a l
 - in-toto (can be validated via runtime trace attestations)
 - Tekton (Pipelines)
 
-## 14. Ensure Software Factory has minimal network connectivity.
+## 14. Ensure Software Factory has minimal network connectivity
 
 ### Tool capability