ci: pin Bazel to 7.5.0, commit lockfile, require lockfile is fresh in CI build

Author: johnbartholomew

.bazelversion

@@ -0,0 +1 @@
+7.5.0

.github/workflows/build_and_test.yml

@@ -85,7 +85,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Build
         run: |
-          bazel build -c opt //cmd:all
+          bazelisk build --lockfile_mode=error -c opt //cmd:all
       - name: Test
         run: |
-          bazel test //...
+          bazelisk test --lockfile_mode=error //...