Consistently use --locked for cargo commands

[jieyouxu]

Summary

Helps with #7037 but does not completely adddress it:

• We still download, build and run the ecosystem integration test repositories without --locked.

For cases modulo the ecosystem integration tests, use --locked consistently -- in CI, bootstrap, docs, test harness, so that we use the exact dependencies checked in via Cargo.lock lockfiles instead of floating resolution, where we risk being exposed to fresh supply-chain attacks¹.

Reminded me to double-check after yesterday's supply-chain attack.

Footnotes

1. Obviously this won't help with long-term supply-chain attacks that get into the lockfile, but defense-in-depth etc. ↩

[jieyouxu]

Oh that's interesting, right, we don't check in lockfiles for the integration crates (since we just clone the repos)

[ytmimi]

We should also add --locked when building from source in the Diff-Check 😁

rustfmt/check_diff/src/lib.rs

Lines 580 to 589 in 3210089

	info!("Building rustfmt from source");
	let Ok(_) = Command::new("cargo")
	.current_dir(dir)
	.args(["build", "-q", "--release", "--bin", "rustfmt"])
	.output()
	else {
	return Err(CheckDiffError::FailedSourceBuild(
	"Error building rustfmt from source",
	));
	};

[jieyouxu]

Discussion: I considered if we can use --locked for the ecosystem integration tests. My assessment is that we can't in the general case:

• Some of these, like bitflags, are library crates that do not check in a lockfile. We can technically patch in a lockfile ourselves but that's a maintenance PITA.
• We could consider using --locked iff the repo has a lockfile, but cf. no-lockfile case above.

View changes since the review

[jieyouxu]

Changes since last review:

• Added --locked for check_diff
• It occurred to me that we can't generally use --locked for ecosystem repos. See Consistently use --locked for cargo commands #7040 (comment).

The ecosystem crate case feels a bit iffy to me, because that's a very large surface area versus rustfmt's own dependency graph. I think that will be helped once cargo stabilizes -Zmin-publish-age which might help us out here...

@rustbot review