## Overview

This adds a CI step to require that all dependencies used in the workspace are either audited or exempted for audit, using the [`cargo-vet`](https://github.com/mozilla/cargo-vet) workflow and tool. It is a bit of an experiment to see how it behaves in our open source crates and to expose more of our devs to the workflow and see how it works.

## New workflow

In general when adding or changing any dependencies one need to keep the audit config & imports up-to-date now or CI will fail, this is done by running `cargo vet` which will tell which new/updated dependencies are not exempted or audited. To add all new dependencies to the list of exemptions (if they don't have imported audits) one can simply run `cargo vet regenerate exemptions` and then check in the file in the PR doing the update. It is also good to sometimes run `cargo vet regenerate imports` or `cargo vet prune` to re-import the list of audit registries (including our own) which removes crates from the exemption list if we have an audit of that exact version.

See the [cargo-vet book](https://mozilla.github.io/cargo-vet/) for more details about this new workflow. In general I expect us mostly to just update the exemptions/imports on PRs, not actively audit all dependencies for this project, as that is something we are doing for our other bigger internal projects (see Embark internal https://github.com/EmbarkStudios/ark/issues/7090).

Also see #147 (comment) as an example of how it can look like when upgrading a dependency in this repo and what next steps to run.

## Implementation details

For now this builds `cargo-vet` from source in CI (but does cache it), this works but is not fully ideal though not a bottleneck in practice. Should be replaced with pre-builds later on: 
- mozilla/cargo-vet#484

This PR was generated by running `cargo dist init` and selecting
all the default options. It seems to have pretty sane behaviour
out of the box.

This requires the repository URL fix in mozilla#599
to work correctly.

Fixes mozilla#484

This PR was generated by running `cargo dist init` and selecting
all the default options. It seems to have pretty sane behaviour
out of the box.

This requires the repository URL fix in mozilla#599
to work correctly.

Fixes mozilla#484

This PR was generated by running `cargo dist init` and selecting
all the default options. It seems to have pretty sane behaviour
out of the box.

This requires the repository URL fix in mozilla#599
to work correctly.

Fixes mozilla#484