ci: use locked flag so we pin versions of dependencies

Author: adsharma

.github/workflows/checks.yml

@@ -143,7 +143,7 @@ jobs:
         uses: taiki-e/install-action@nextest
 
       - name: Run unit tests
-        run: cargo ${{ env.HACK }} nextest run --lib
+        run: cargo --locked ${{ env.HACK }} nextest run --lib
 
   integration-tests:
     if: false