Generate Cargo.lock before running the security audit

[ajaysehwal]

Since we bumped rustsec/audit-check to v2 in b3fe392, the action no longer generates a lockfile itself (v1.4.1 did). As we don't commit Cargo.lock (we're a library, see .gitignore), every scheduled run of the Security Audit
workflow since 2026-04-09 has failed:

error: not found: Couldn't load ./Cargo.lock
##[error]Unexpected end of JSON input

The last 5 scheduled runs all concluded with failure, and the last successful run was on 2026-04-08. In practice, this means we haven't been notified about any new RUSTSEC advisories for about six months (the last RUSTSEC issue we filed was #836).

Here, we fix this by generating the lockfile in a dedicated step before running the audit.

Notes for reviewers

• I haven't yet confirmed that the workflow passes with this change; I'll
  trigger it via workflow_dispatch and link the run here.
• Once the audit runs again, we'll likely see reports for advisories in
  dev-only dependencies that currently have no fix, e.g., via the
  ldk-node =0.6.2 dev-dependency used by the upgrade tests (rustls 0.21,
  rustls-webpki 0.101, h2 0.3, rustls-pemfile 1.0.4). If that gets too noisy,
  we could add them to the action's ignore: input in a follow-up. Happy to
  do that here instead if preferred.
• The audit runs on a fresh dependency resolution, so it checks what downstream
  users get today rather than a pinned lock.

AI disclosure: this change was prepared with the assistance of AI tools (Claude Code).

[ldk-reviews-bot]

I've assigned @tnull as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.