Add MSRV Cargo-minimal.lock and Cargo-recent.lock files

Without commited lock files, CI dependency resolution can pull in
transitive dependencies that require a newer compiler than the project's
MSRV. The triggering issue was that bindgen v0.72 depends on rustc-hash
v2.x, and the recent release of rustc-hash v2.1.2 introduced a rustc
1.77.0 requirement, breaking the MSRV build against rustc 1.71.0.

Cargo-minimal.lock pins dependencies to their oldest MSRV-compatible
versions. Cargo-recent.lock pins to the latest patch versions compatible
with the MSRV compiler. The CI msrv-check job now runs twice as a
matrix, once with each lock file, similar to the approach used by
rust-bitcoin. Both lockfiles pin rustc-hash below 2.1.2 to avoid the
incompatible release, to 2.1.0 in the minimal lockfile and 2.1.1 in the
recent lockfile.

tempdir is bumped to >=0.3.6 in dev-dependencies to prevent it from
resolving to an older version that depends on an incompatible rand
release under minimal-versions.

See also: #147

Author: alexanderwiederin

.github/workflows/ci.yml

@@ -9,8 +9,12 @@ env:
 
 jobs:
   msrv-check:
-    name: Build with MSRV
+    name: Build with MSRV - ${{ matrix.dep }} deps
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        dep: [minimal, recent]
     steps:
     - uses: actions/checkout@v3
 
@@ -28,15 +32,18 @@ jobs:
     - name: Cache dependencies
       uses: Swatinem/rust-cache@v2
 
+    - name: Set Cargo.lock
+      run: cp Cargo-${{ matrix.dep }}.lock Cargo.lock
+
     - name: Build with MSRV
       run: |
         # Ensure we're using the right version
         rustc --version
         # Build the project
-        cargo build --all-features
+        cargo build --all-features --locked
  
     - name: Run tests with MSRV
-      run: cargo test --all-features
+      run: cargo test --all-features --locked
 
   build:
     name: Build and Test