Clarify why bins have Cargo.lock but libs don't

Closes #525 

r? @wycats