Fix Docker build by using --locked for cargo-chef install

cargo-chef's transitive dependencies (cargo-platform, cargo_metadata,
guppy, target-spec) bumped their MSRV to Rust 1.86-1.88, breaking the
install on our pinned Rust 1.85.0 toolchain. Using --locked forces
cargo to use cargo-chef's bundled lockfile, which is tested against
its supported Rust versions.