Make our builds reproducible

[lukipuki]

Is your feature request related to a problem?
New Rust versions can break our builds.

Describe the solution you’d like
Pin Rust version used in CI and also add Cargo.lock file which pins exact versions of dependencies.

[lukipuki]

Note: a MSRV-aware resolver was only introduced in 1.84: https://blog.rust-lang.org/2025/01/09/Rust-1.84.0/#cargo-considers-rust-versions-for-dependency-version-selection

This means that without Cargo.lock our builds can break if a dependency's MSRV goes beyond what we're using (#48 sets it to 1.76).