Fix Docker build by using --locked for cargo-chef install (#2222)

cargo-chef's transitive dependencies (cargo-platform, cargo_metadata,
guppy, target-spec) bumped their MSRV to Rust 1.86-1.88, breaking the
install on our pinned Rust 1.85.0 toolchain. Using --locked forces cargo
to use cargo-chef's bundled lockfile, which is tested against its
supported Rust versions.