abuild: set --locked for all cargo invocations

That ensures that we always use the versions specified in the Cargo.lock file, which is required for reproducible builds