Fix MSRV check by checking in Cargo.lock

[alamb]

NOTE: All of this PR is Cargo.lock. I swear it is easy to review...

Which issue does this PR close?

• Closes msrv check failing on main due to tonic@0.14.6 #9938.
• Modeled on [56_maintenance] Fix cargo_audit: Pin cargo-msrv and Cargo.lock in CI #9902.

Rationale for this change

The guidance on lock files from the Cargo folks changed a while ago: https://blog.rust-lang.org/2023/08/29/committing-lockfiles/

The MSRV check is failing on main because dependency resolution currently uses the latest compatible versions from crates.io for each package. The newest tonic release now require a newer Rust version than the workspace MSRV.

Here is the reported CI failure: https://github.com/apache/arrow-rs/actions/runs/25472344356/job/74738606768

error: rustc 1.85.0 is not supported by the following packages:
  tonic@0.14.6 requires rustc 1.88
  tonic-prost@0.14.6 requires rustc 1.88

What changes are included in this PR?

This PR checks in a root Cargo.lock so CI verifies MSRV against the dependency set we control, rather than the tip of all dependency ranges. The generated lockfile pins the tonic 0.14 crates to 0.14.5, which supports Rust 1.85.

Note this does not change code in the crates. It only pins dependency resolution for workspace builds and CI.

This will result in more dependabot PRs to explicitly update the crate versions, but I think that is a good thing. I think the existing config file will work fine https://github.com/apache/arrow-rs/blob/main/.github/dependabot.yml

Are these changes tested?

Yes, by CI

This passed locally with Rust 1.85.0.

Are there any user-facing changes?

No. This only checks in the root lockfile used for dependency resolution in workspace builds and CI.

[Jefffrey]

I wonder if we'll need to bump open PR limit and/or group these other dependency updates like we did in DataFusion

• apache/datafusion#19730
• apache/datafusion#20457

[alamb]

I wonder if we'll need to bump open PR limit and/or group these other dependency updates like we did in DataFusion

• apache/datafusion#19730
• apache/datafusion#20457

I think arrow has many fewer dependencies so I am hoping we can avoid having to do so, but I suppose we'll see

[alamb]

Thank you for the review @Jefffrey