Add lock file for reproducible builds

We need a Cargo.lock file to enforce reproducible builds (and it's required by the --frozen argument passed into Cargo build).