Commit lockfile

[danieleades]

This PR is stacked on top of #874, so i'll leave it as a draft until that's merged.

as per rust's official docs, repos that have automatic version bumping and MSRV checks should commit their lockfiles to facilitate reproducible builds.

Committing the lockfile changes the behaviour of dependabot- any patch updates will generate PRs now, but only major updates will generate PRs without the lockfile. I've therefore also modified the dependabot config to suppress patch and minor updates in order to match the behaviour in #874.

There is an alternative approach, which is to allow dependabot to generate all the noisy patch updates. In some of my repos i've mitigated the noise by also adding a job to automerge dependabot PRs that pass all checks (for example, in my sphinx graph repo)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (6814180) 94.38% compared to head (fe8d807) 94.37%.
Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #875      +/-   ##
==========================================
- Coverage   94.38%   94.37%   -0.02%     
==========================================
  Files          48       48              
  Lines        6665     6666       +1     
==========================================
  Hits         6291     6291              
- Misses        374      375       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.