Check in Cargo.lock files

https://mail.mozilla.org/pipermail/rust-dev/2014-March/009094.html implies
that lockfiles should be checked into the repo. Even though we don't use any
actually-useful version numbers yet, it seems harmless to add them.