Pin cargo public-api and other tools

[Kixunil]

We pin nightly so that our tests don't break if there's a bug in nightly but it ironically broke our CI becuase we didn't pin cargo public-api which requires nightly.

All tools should be pinned and the pins should be updated on schedule.

[apoelstra]

Definitely +1. I would appreciate it if we could pin cargo-public-api in a way that my local CI can also pull it.

I think this might be the only offender right now. Though if we start doing cargo-mutants we will need to pin that too.

[tcharding]

This was fixed in #2893 but I have a suspicion there is something funny going on still, see #2895 and #2900 for context.