Reconsider running generate-lockfiles in docker

[brson]

Containerization seems to add significant time to prepare-ex, and there's no sandboxing requirement here.

[aidanhs]

Or: start up a single container and do it all in there.

[pietroalbini]

This can also be done for cargo fetch.

[pietroalbini]

Implementing this myself in an unrelated refactoring.