Prevent Cargo from trying to update swh-graph's dependencies

The --locked option forces Cargo to use the lockfile declared by swh-graph, which was carefully written to avoid conflicts between two Arrow versions that are used as transitive dependencies through different packages.

When Cargo tries to update one, it ends up with incompatible versions, causing a compilation failure.