Revert "cargo update dependencies before building"

cargo update is not generic enough because there are subprojects without
a Cargo.lock