Fail CI if the lock file needs an update (#730)

This uses `--locked` on CI to ensure that if the lock file needs
changing it's reflected in the PR instead of letting CI accidentally and
silently update the lock file for us.

.github/workflows/main.yml

@@ -155,7 +155,7 @@ jobs:
     # tests
     - run: rustup target add wasm32-wasi
 
-    - run: cargo fetch
+    - run: cargo fetch --locked
 
     # Build and test all features except for lightbeam
     - run: cargo test --features test_programs --all --exclude lightbeam -- --nocapture