Install cargo tools with locked dependencies

Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies.

I went through all `rg "cargo install"` hits in the repository and added `--locked` to all but explanatory examples. I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/ef3412518e207bea6035a1bd01f3821b.