Overlapping functionality between deps. cargo-lock & cargo

We currently depend on both cargo-lock & cargo. But their functionality is a bit overlapping (or, mostly overlapping). It would be good if we needed just one of them (and `cargo` seems to cover more things than `cargo-lock`, so it'll likely be that one).

The issue names no files or tests. Start by tracing how the cargo-lock and cargo dependencies are used in the repository, then run the existing test suite; done means the overlapping functionality is covered by one dependency without regressions.

Written by the indexing model from the issue text.