Keep Cargo.lock in the repository

[astralblue]

Our workspace is mostly binary, so it is better to explicitly record proven-working dependencies.

See rust-lang/cargo#6172 for details.

[astralblue]

To quote https://github.com/rust-lang/cargo/issues/6172#issuecomment-429905812:

Ah not necessarily, it depends on your project. If it's intended to mostly be libraries then you won't want a Cargo.lock because consumers of your library aren't using Cargo.lock. If, however, it's just for your usage and no one else is depending on it externally, then it probably makes sense to use Cargo.lock to ensure reproducible builds and such betwee revisions (and track regressions).

While this often correspond to binary/library, that isn't always the case!