[ci] Relock staged sources without advancing pins

[rebtoor]

Summary

Speculative content-provider builds stage Zuul-patched src/ trees, then still compile against the committed requirements.lock.<stream>. That mismatch is what fails jobs like heat openstack-check when a staged change raises a lower bound past the lock (for example oslo.versionedobjects>=3.12.0 vs lock 3.11.0).

Reusing update-sources would refresh constraints, but it also clones unstaged sibling repos at branch tip and rewrites sources.txt. This change adds build.sh sync-locks:

• Refresh upper-constraints.txt.<stream> from the stream branch tip, or from a Zuul openstack/requirements checkout (REQUIREMENTS_SRC) when one is in the buildset.
• Leave staged src/ in place; clone missing siblings at the committed pin.
• Regenerate requirements.lock.<stream> and buildrequirements.lock.<stream> from current src/*/requirements.txt.
• Do not rewrite sources.txt or rpms.in.yaml.

The content provider runs tox -e sync-locks only when sources were actually staged, using ensure-tox from zuul-jobs.

Test plan

• tests/test_update_sources.sh sync-locks cases (pins preserved, UC from tip / REQUIREMENTS_SRC, clone-at-pin, staged tree kept, no rpms.in.yaml, default-stream symlinks)
• Zuul content-provider job with a staged service that needs a newer constraint than the committed lock
• Confirm a no-stage content-provider run skips sync-locks

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign stuggi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment