Re-add it-rejects-outdated-lock test fixture

The it-rejects-outdated-lock test was removed in !68 (merged) (nixica 0.9.0 update) because nix flake lock doesn't re-resolve already-locked inputs, making it impossible to create a reliably outdated lock file that triggers a diff in CI.

The test needs a new approach — possibly using nix flake update instead of nix flake lock in the validate:flake-lock module, or using a custom lock manipulation that works across nix versions.