chore(ci): add Cargo.lock file (#3)

I'd consider us a binary package, so [we should track our lock file in vcs](rust-lang/cargo#315). Better for auditing shipped dependencies and better for build cache/reproducibility.