improve the reproducibility of `CI`

[cospectrum]

All dependencies should be locked, unless the purpose of the workflow is to check the latest versions. The msrv should be tested with minimal dependencies (either direct or indirect).

dependencies to lock

• crates from crates.io (include Cargo.lock in git)
• official rust toolchain: rustc, cargo, clippy, miri
• 3d party tools and github actions: cargo hack, cargo nextest, semver, sdl2, actionlint

[cospectrum]

I plan to start working on it.