Ensure all jobs run with `--locked`

Adding `--locked` will ensure that `Cargo.lock` is kept up to date. It should generally stay up to date as long as folks recompile locally after any changes that change dependencies, but having `--locked` will ensure that nothing can get through CI without updating the lockfile.

We might already be doing this, first check, then implement if needed.