Run CI with unlocked deps as well as with locked deps

[angelikatyborska]

https://hexdocs.pm/elixir/library-guidelines.html#dependency-handling recommends:

The best practice of handling mix.lock file therefore would be to keep it in VCS, and run two different Continuous Integration (CI) workflows: the usual deterministic one, and another one, that starts with mix deps.unlock --all and always compiles your library and runs tests against latest versions of dependencies. The latter one might be even run nightly or otherwise recurrently to stay notified about any possible issue in regard to dependencies updates.