Have different warning types for different events when validating lockfile

Currently, maven-lockfile validation gives the same warning when,
- A package download has been tampered with
- A package version has changed

As suggested by Rhys, a user might want to be protected against tampered packages rather than legitimate version updates. So, we can have different warnings for these cases, to make it clear.  