Re-pinning external lockfiles should not change crate versions

This issue was discovered in https://github.com/bazelbuild/rules_rust/pull/1735#discussion_r1059788039 (special thanks to @dtolnay!)

Currently if you have a `crates_vendor` target that uses a label to an external target as a `cargo_lockfile`, running the target with `--repin` will repin dependencies. However since the original lockfile is from an external dependency and generally immutable to users, re-pinning should either be rejected or a no-op. Users who want to update dependencies should create their own lockfiles or update the lockfile in the external repository.

### WORKSPACE.bazel
```starlark
workspace(name = "bug_repro")

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
name = "names",
build_file = "//cargo_remote:BUILD.names.bazel",
sha256 = "eab40caca5805624ba31d028913931c3d054b22daafff6f43e3435cfa9fb761e",
strip_prefix = "names-0.13.0",
urls = ["https://github.com/fnichol/names/archive/refs/tags/v0.13.0.zip"],
)
```

### BUILD.bazel
```starlark
load("@rules_rust//crate_universe:defs.bzl", "crates_vendor")

crates_vendor(
name = "crates_vendor",
cargo_lockfile = "@names_external//:Cargo.lock", # <- This should prevent repins since the current workspace is "bug_repro", not "names_external"
manifests = ["@names_external//:Cargo.toml"],
mode = "remote",
)
```

### Expectation
Running `bazel run //:crates_vendor -- --repin` should result in the exact same dependencies found in the `names_external` repository.