Use --locked when building in CI (#31720)

Thus the build will immediately fail if a PR modifies Cargo.toml but
forgets to include the changes in Cargo.lock

This was previously checked by lockfile_changed.sh after building
normally, wasting resources.

.github/workflows/mac.yml

@@ -90,7 +90,7 @@ jobs:
           brew install gnu-tar
       - name: Build (${{ inputs.profile }})
         run: |
-          python3 ./mach build --${{ inputs.profile }}
+          python3 ./mach build --locked --${{ inputs.profile }}
           cp -r target/cargo-timings target/cargo-timings-macos
       - name: Smoketest
         uses: nick-fields/retry@v3