maint/via-cargo-install-in-ci should imply --locked

The --locked argument should be hoisted from every call site into the script.

This should happen after !350 (merged), to avoid a semantic conflict.