Implement --locked for build-std

[adamgemmell]

What does this PR try to resolve?

This fixes rust-lang/wg-cargo-std-aware#38

How should we test and review this PR?

Drop the version of a dependency in the rust-src Cargo.lock (for example, libc down to 0.2.149). Then build something with build-std.
Before this patch, libc would be silently upgraded to the latest semver-compatible version. Now Cargo will return an error.

Additional information

In order for Cargo to actually attempt to write the std lockfile we need to resolve with optional_deps again. Optional packages aren't actually built.

This works for now but the behaviour will need a rethink for rust-lang/wg-cargo-std-aware#64 - perhaps adding some concept of --locked but only for the std parts of a dependency graph..

[rustbot]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @epage (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

• @rustbot author: the review is finished, PR author should check the comments and take action accordingly
• @rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

[adamgemmell]

r? author

[rustbot]

Failed to set assignee to author: cannot assign: response: {"message":"Not Found","documentation_url":"https://docs.github.com/rest/issues/assignees#add-assignees-to-an-issue","status":"404"}

Note: Only org members with at least the repository "read" role, users with write permissions, or people who have commented on the PR may be assigned.