Enforce Cargo.lock is up-to-date in lint CI (#15839)

* Enforce `Cargo.lock` is up-to-date in lint CI

It is currently possible to merge changes to `main` that leave
`Cargo.lock` needing updates.  This enforces, as part of the CI lint
job, that `Cargo.lock` is unchanged when running `cargo` compilation
commands.  It's hard to do this via `tox` because the package is highly
opinionated and doesn't permit running commands before package build.

We may want to go further in the future in CI and enforce that the
entire `git` repository is clean after the equivalent local commands,
but that would require a bit more work because there are differences in
CI where we generate files that are not necessarily covered in
`.gitignore` (such as coverage and PGO steps).

* Fix `Cargo.lock`

Author: jakelishman

.github/workflows/lint.yml

@@ -31,5 +31,8 @@ jobs:
       - name: Run lint
         run: |
           set -e
+          # Check that `Cargo.lock` is checked in and up-to-date before attempting to build the
+          # package. The exact command isn't important, it should just be cheap and update the lock.
+          cargo metadata --format-version=1 --locked >/dev/null
           make cformat
           tox -e lint