Make sure our CI workflows build with `--locked`

E.g. double-check that we don't try to just fetch newest-compatible versions; instead, we generally should use the checked-in lockfile.

https://github.com/rust-lang/rustfmt/blob/164f17c60f5728814999c9c08e93facb98094600/.github/workflows/check_diff.yml#L49

(Would like to double-check after reminded by today's https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/)