Auto merge of #10902 - epage:lock, r=ehuss

fix(add): Update the lock file

This is done in the command, rather than in the op,
- To consistently construct the `Workspace`
- It is more composable as an API

A downside is we update the git dependencies a second time and any sources we didn't initially update.

Unlike the proposal in the attached issue, this does not roll back on error.
- For some errors, the user might want to debug what went wrong.  Losing the intermediate state makes that difficult
- Rollback adds its own complications and risks, including since its
  non-atomic

We've already tried to address most potential errors during `cargo add`s processing.  To meet this desire, we now error if `--locked` is passed in and we would change the manifest.  See that individual commit's message for more details.

Fixes #10901