Cargo.lock: pin dependencies

As discussed in #1698.

This also loosen the dependency to `chacha20`.

Not binding to a strict version of chacha20 (only a minimum) would 
make for a much smoother release process. Especially to get over the API
breaks humps coming in rand_core 0.10.0-rc.3

Author: baloo

.github/workflows/test.yml

@@ -85,9 +85,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - name: Not MSRV
-        if: ${{ matrix.variant != 'MSRV' }}
-        run: cargo generate-lockfile --ignore-rust-version
       - name: Install toolchain
         uses: dtolnay/rust-toolchain@master
         with:

.gitignore

@@ -1,4 +1,3 @@
 target
-Cargo.lock
 rand_wasm_bindgen_test*.[tj]s
 rand_wasm_bindgen_test*.wasm

Cargo.lock

@@ -76,7 +76,7 @@ exclude = ["benches", "distr_test"]
 rand_core = { version = "0.10.0-rc-2", default-features = false }
 log = { version = "0.4.4", optional = true }
 serde = { version = "1.0.103", features = ["derive"], optional = true }
-chacha20 = { version = "=0.10.0-rc.5", default-features = false, features = ["rng"], optional = true }
+chacha20 = { version = "0.10.0-rc.5", default-features = false, features = ["rng"], optional = true }
 getrandom = { version = "0.3.0", optional = true }
 
 [dev-dependencies]