chore: specify --locked when cargo installing cargo-audit

[Jefffrey]

same as we do elsewhere

arrow-rs/.github/workflows/miri.yaml

Line 63 in c8eba1a

cargo install cargo-nextest --version 0.9.132 --locked

arrow-rs/.github/workflows/rust.yml

Lines 121 to 123 in c8eba1a

	# --locked uses cargo-msrv's pinned Cargo.lock; without it an unpinned transitive
	# dep (aws-runtime) resolves to a version that fails to compile (E0282)
	run: if which cargo-msrv ; then echo "using existing cargo-msrv binary" ; else cargo install cargo-msrv --locked ; fi

• see reasoning in this comment; we're not failing right now, but its good to prevent any future issues