Add back missing cart_locked state.

It was missing from the `state-machine.yml`

/cc @winzou