For at least one job, run the first cargo run with --locked.  This
will fail if the lockfile needs updating.

I have verified that this correctly detects this situation:
  https://gitlab.torproject.org/Diziet/arti/-/pipelines/37692
failed.  Now I have rebased this branch onto main to get the fix to
Cargo.lock.