build: Use Cargo.lock for all crates

[dhedey]

Summary

This PR adds full Cargo.lock support to radix engine and scrypto, with the aim to (A) improve reproducibility of builds and (B) to reduce the attack surface for supply chain attacks.

• Source controls a Cargo.lock which was previously in the .gitignore
  • IMPORTANT: This will cause issues when people travel past this commit, due to a clash with everyone's local gitignore'd version. This is inevitable, sorry. The workaround is below.
• Adds support for a --locked parameter to scrypto build, and a SCRYPTO_CARGO_LOCKED environment variable - which can be set in CI to ensure that all builds inside tests require a cargo lock.
• Makes use of SCRYPTO_CARGO_LOCKED=1 in CI to ensure all of our tests are using fixed versions
• Combines radix-clis into the main workspace, as the only reason for separating it is no longer valid
• Adds a Cargo.lock to the scrypto new-package, aligned with the engine's Cargo.lock - and the tests check that it can be build with --locked after creation, to verify the Cargo.lock file is complete.
• At this point, I ensured all the Cargo.lock files were aligned as best as possible:
  • I took the node's Cargo.lock as a basis
  • I then ran it against the root Cargo.lock which pruned it
  • I then copied that to all the other Cargo.lock files used in the test assets, and ran builds to prune those.

Workaround for spurious errors on git checkout when passing across this PR merge:

rm ./Cargo.lock
rm ./radix-clis/tests/blueprints/Cargo.lock
rm ./scrypto-test/assets/blueprints/Cargo.lock
rm ./scrypto-test/tests/blueprints/Cargo.lock
rm ./simulator/tests/blueprints
rm ./scrypto-compiler/tests/assets/scenario_1/Cargo.lock
rm ./scrypto-compiler/tests/assets/scenario_2/Cargo.lock

Testing

I've tested the SCRYPTO_BUILD_USE_CARGO_LOCK parameter locally. Otherwise, mostly I want to see existing CI passing.

Update Recommendations

Developers may need to delete a Cargo.lock locally in order to merge/update their git repos across this point.

[github-actions]

Phylum Report Link

[github-actions]

Benchmark for 62e5b56

Click to view benchmark

Test	Base	PR	%
costing::bench_prepare_wasm	63.4±0.12ms	66.3±4.36ms	+4.57%
costing::decode_encoded_i8_array_to_manifest_raw_value	19.3±0.00ms	19.3±0.00ms	0.00%
costing::decode_encoded_i8_array_to_manifest_value	42.3±0.07ms	42.0±0.06ms	-0.71%
costing::decode_encoded_tuple_array_to_manifest_raw_value	61.2±0.20ms	61.0±0.28ms	-0.33%
costing::decode_encoded_tuple_array_to_manifest_value	97.8±0.15ms	99.0±0.24ms	+1.23%
costing::decode_encoded_u8_array_to_manifest_raw_value	31.8±0.10µs	26.1±0.11µs	-17.92%
costing::decode_encoded_u8_array_to_manifest_value	42.4±0.06ms	42.1±0.06ms	-0.71%
costing::decode_rpd_to_manifest_raw_value	12.8±0.02µs	12.8±0.02µs	0.00%
costing::decode_rpd_to_manifest_value	11.3±0.05µs	10.6±0.06µs	-6.19%
costing::deserialize_wasm	1254.3±7.66µs	1255.3±2.73µs	+0.08%
costing::execute_transaction_creating_big_vec_substates	717.8±11.16ms	699.6±13.65ms	-2.54%
costing::execute_transaction_reading_big_vec_substates	585.6±0.89ms	586.0±1.12ms	+0.07%
costing::instantiate_flash_loan	937.9±678.32µs	1048.2±1806.73µs	+11.76%
costing::instantiate_radiswap	1166.9±2000.77µs	1401.4±4324.16µs	+20.10%
costing::spin_loop	21.5±0.11ms	20.6±0.03ms	-4.19%
costing::validate_sbor_payload	27.2±0.06µs	27.7±0.07µs	+1.84%
costing::validate_sbor_payload_bytes	200.7±0.46ns	201.8±0.89ns	+0.55%
costing::validate_secp256k1	76.7±0.04µs	76.7±0.09µs	0.00%
costing::validate_wasm	34.2±0.11ms	33.7±0.04ms	-1.46%
decimal::add/0	8.4±0.00ns	8.4±0.00ns	0.00%
decimal::add/rust-native	9.9±0.01ns	9.9±0.02ns	0.00%
decimal::add/wasmi	229.3±0.48ns	226.9±0.52ns	-1.05%
decimal::add/wasmi-call-native	2.1±0.00µs	2.2±0.00µs	+4.76%
decimal::div/0	186.7±0.10ns	185.4±0.16ns	-0.70%
decimal::from_string/0	155.8±0.37ns	152.3±0.13ns	-2.25%
decimal::mul/0	149.6±0.33ns	148.8±0.43ns	-0.53%
decimal::mul/rust-native	148.2±0.12ns	149.2±0.16ns	+0.67%
decimal::mul/wasmi	11.8±0.10µs	12.0±0.05µs	+1.69%
decimal::mul/wasmi-call-native	2.3±0.00µs	2.3±0.00µs	0.00%
decimal::pow/0	691.3±0.63ns	699.4±1.30ns	+1.17%
decimal::pow/rust-native	664.0±0.39ns	666.9±0.95ns	+0.44%
decimal::pow/wasmi	56.6±0.52µs	56.4±0.27µs	-0.35%
decimal::pow/wasmi-call-native	2.5±0.00µs	2.5±0.01µs	0.00%
decimal::root/0	7.7±0.01µs	8.0±0.01µs	+3.90%
decimal::sub/0	8.2±0.01ns	8.4±0.03ns	+2.44%
decimal::to_string/0	441.4±0.47ns	448.7±1.42ns	+1.65%
precise_decimal::add/0	9.1±0.02ns	8.9±0.07ns	-2.20%
precise_decimal::add/rust-native	10.7±0.03ns	10.7±0.04ns	0.00%
precise_decimal::add/wasmi	299.0±1.80ns	280.6±1.36ns	-6.15%
precise_decimal::add/wasmi-call-native	2.8±0.00µs	2.8±0.00µs	0.00%
precise_decimal::div/0	317.3±0.47ns	318.5±4.04ns	+0.38%
precise_decimal::from_string/0	198.6±0.60ns	212.1±0.29ns	+6.80%
precise_decimal::mul/0	366.9±1.30ns	370.3±3.98ns	+0.93%
precise_decimal::mul/rust-native	321.2±0.39ns	331.4±4.24ns	+3.18%
precise_decimal::mul/wasmi	33.9±0.20µs	34.7±0.11µs	+2.36%
precise_decimal::mul/wasmi-call-native	3.2±0.00µs	3.3±0.01µs	+3.12%
precise_decimal::pow/0	1935.2±1.80ns	1928.9±2.22ns	-0.33%
precise_decimal::pow/rust-native	1554.8±3.54ns	1574.3±2.46ns	+1.25%
precise_decimal::pow/wasmi	163.1±0.99µs	166.4±0.69µs	+2.02%
precise_decimal::pow/wasmi-call-native	5.7±0.01µs	5.7±0.01µs	0.00%
precise_decimal::root/0	57.0±0.03µs	58.3±0.03µs	+2.28%
precise_decimal::sub/0	9.1±0.03ns	9.0±0.03ns	-1.10%
precise_decimal::to_string/0	701.5±1.02ns	692.7±1.99ns	-1.25%
schema::validate_payload	364.7±1.34µs	369.1±1.55µs	+1.21%
transaction::radiswap	5.3±0.05ms	5.1±0.02ms	-3.77%
transaction::transfer	1910.1±2.13µs	1889.1±1.73µs	-1.10%
transaction_processing::prepare	2.6±0.00ms	2.6±0.00ms	0.00%
transaction_processing::prepare_and_decompile	6.5±0.02ms	6.3±0.04ms	-3.08%
transaction_processing::prepare_and_decompile_and_recompile	32.1±0.28ms	24.9±0.80ms	-22.43%
transaction_validation::validate_manifest	42.8±0.07µs	42.9±0.05µs	+0.23%
transaction_validation::verify_bls_2KB	1001.8±6.37µs	1035.5±45.89µs	+3.36%
transaction_validation::verify_bls_32B	1036.6±20.78µs	1006.2±13.06µs	-2.93%
transaction_validation::verify_ecdsa	74.6±0.05µs	74.5±0.06µs	-0.13%
transaction_validation::verify_ed25519	55.1±0.05µs	57.4±0.40µs	+4.17%

[github-actions]

Docker tags
docker.io/radixdlt/private-scrypto-builder:62e5b5670a