Consider committing lockfile

In https://github.com/amethyst/shred/pull/228 I ran into the issue of the CI failing due to a dependency with a higher MSRV. If we had a lockfile to pin dependencies this would not have occurred.

Ideally, we would have CI running with both the pinned versions and without the lockfile. Since we already test with multiple compiler versions, I think it would be suitable to use a lockfile for the MSRV toolchain, and the others could ignore the lockfile.