Clarify why bins have Cargo.lock but libs don't

Closes #525
auto merge of #534 : alexcrichton/cargo/issue-525, r=brson

Closes #525 

r? @wycats