Recommend --locked for cargo install

[samestep]

This PR changes README.md so it recommends users pass the --locked flag to cargo install, which should prevent some surprises. This should also make the behavior more similar to the cargo binstall example command right below.

[alexcrichton]

Thanks for the PR! Out of curiosity was there a concrete breaking thing that happened as a result of missing --locked?

[samestep]

@alexcrichton there was not, so this might not actually matter at all; in that case I apologize for the noise!

[alexcrichton]

Oh no worries! I don't think that this is an unreasonable suggestion, I just personally try to stick to Cargo defaults where possible. I understand though that Cargo's defaults in this regard are somewhat contentious and there's definitely breakage that's possible without --locked. Additionally given the breadth of the full dependency graph with all subcommands enabled it seems like having this is probably a good idea to ensure that breakage never happens in the future.