ci: pin bazel version to 7.5.0, and require up-to-date lockfile for CI build

Bazel 7 is currently in maintenance and supported to the end of 2026.

The CI build should require an up-to-date lockfile so that we can try
to catch before merging if Bazel dep changes are made without the
corresponding lockfile change.

Author: johnbartholomew

.bazelversion

@@ -0,0 +1 @@
+7.5.0

.github/workflows/ci.yml

@@ -61,8 +61,8 @@ jobs:
             ~/.cache/bazel
             ~/.cache/bazelisk
           key: ${{ runner.os }}-bazel-cache
-      - run: bazel build //...
-      - run: bazel test //...
+      - run: bazelisk build --lockfile_mode=error //...
+      - run: bazelisk test --lockfile_mode=error //...
 
   all:
     name: Check all