fix(ci): install cargo-audit with --locked

[kylehgc]

Original fix. The Security Scan job on develop (run 33812431685, first red after the 2026-09-03 sync) fails before the audit runs: cargo install cargo-audit now resolves tinyvec 1.13.0, released today, which does not compile.

   Compiling tinyvec v1.13.0
error: cannot find macro `vec` in this scope
error: could not compile `tinyvec` (lib) due to 1 previous error
error: failed to compile `cargo-audit v0.22.2`

--locked makes cargo use cargo-audit's own lockfile, which pins a tinyvec that builds.

Repro, local x64 toolchain

$ cargo install cargo-audit --root $TMP/audit-unlocked     # before (CI's command)
   Compiling tinyvec v1.13.0
error: cannot find macro `vec` in this scope
error: failed to compile `cargo-audit v0.22.2`               exit 101

$ cargo install cargo-audit --locked --root $TMP/audit-locked   # after
   Installed package `cargo-audit v0.22.2`                       exit 0

Upstream's own Security Scan passed at 19:53 UTC today with the unlocked command; the fork's failed at 22:21. Nothing in the repo is involved: the same command fails on a clean machine.

Not a fork divergence

The install line is identical to upstream's ci.yml. Upstream has no open PR or issue for this (searched cargo-audit, tinyvec, locked; PR rtk-ai#3539 touches ci.yml but not this step). An upstream PR follows once this is green here.

Quality gate

YAML-only change; no Rust touched. CI on this branch is the verification.