Build with --locked on CI

[roblabla]

We currently don't check that the lockfile is up to date on CI. This can easily be achieved by passing --locked to every cargo command on CI.