[ci] Check lock files in CI

[jwnrt]

This script regenerates the Bazel, Cargo, and Python lock files and checks for a diff.

[pamaury]

Stupid question: with this check, does that mean that in certain cases, if a new version of package is available, the check will fail because cargo/pip/bazel will resolve to a different version? Here I am thinking about requirements that only specify a major.minor version for example and a new patch appears upstream.

[nbdd0121]

The cargo update command has -w specified to only touch workspace packages without updating their dependencies.

Pip is already checked in ci/scripts/check-generated.sh, so it should be moved/removed from this PR, and we know that it won't be affected by upstream package upgrade.

Not sure about Bazel deps though.

[jwnrt]

Yes, I added -w to prevent Cargo changing versions. I'm not sure about the gen-python-requirements.sh script or Bazel though... I wonder if there's a way to test this.

Both of them come back as up to date and it seems likely there have been new versions since the last time they were changed, so maybe we can assume that they're okay?

[pamaury]

Thanks for the clarification. Let's merge and we'll see how this check behaves. If we notice some issues with python or bazel, we can always do a partial revert.