Fix the broken fuzz build

[Leedehai]

Updated

cargo install cargo-fuzz ignores that package's Cargo.lock file by default and fetches the newest version of that package's dependencies. Among the dependencies, serde released 1.0.200 ~1 day ago, but this new version of serde requires a newer Rust build; otherwise, it will complain use of unstable library feature 'saturating_int_impl', a feature that requires at least Rust 1.74.0 to be stable.

At the moment, due to other considerations Typst chooses to pin this specific CI task's Rust at nightly-2023-09-13, a date that is between the branch dates of 1.73.0 and 1.74.0. The agreed solution is to make cargo install cargo-fuzz respect cargo-fuzz's Cargo.lock file, by adding --locked. This will ensure the dependency serde is pinned to 1.0.193.

Moreover, we also pin cargo-fuzz's version to the most recent release 0.12.0 to minimize surprises should it updates.

Side note: cargo fuzz build --dev requires Rust's nightly build, not beta or stable build. Instead of using the most recent nightly build, we pin this nightly build to a specific date to avoid occasional breakage from Rust development.

---

Original description

It appears the fuzzing errors raised in PR #4055 use of unstable library feature 'saturating_int_impl' is because the Rust version in the fuzz workflow is outdated. See an explanation for a similar issue.

[Leedehai]

This is stubborn, isn't it?

[Leedehai]

Commit 4dc5aee indicates that the fuzz workflow requires a nightly build: https://github.com/typst/typst/actions/runs/8916897272/job/24489105029

Commit 2406e00 indicates pinning the nightly build at the current version used by Typst (https://releases.rs/docs/1.77.0/) is still not sufficient, because there was another, different use of unstable library feature 'proc_macro_byte_character' error: https://github.com/typst/typst/actions/runs/8917063020/job/24489530142