Commit Cargo.lock + cargo update

[phklive]

In this PR I propose to run cargo update on the repo and commit cargo.lock file.

Closes: #1259

[plafer]

I'm late to the conversation, but basically the Rust team has recommended for a long time not to commit the Cargo.lock file for libraries, although has acknowledged last year that some libraries might want to commit it anyway.

I understand the pro's: reproducible builds. But I am not clear yet on how that would interact with downstream users, and if this could cause version conflicts (as explained in the original recommendation).

Are we clear on whether or not this will be an issue, and/or how to mitigate it?

cc @bitwalker which I think was in favor of this change

[bobbinth]

I understand the pro's: reproducible builds. But I am not clear yet on how that would interact with downstream users, and if this could cause version conflicts (as explained in the original recommendation).

My understanding is that it shouldn't affect downstream users (or at least the ones that install these crates from crates.io). As far as I know, Cargo.lock is not a part of a crate (i.e., it does not get published to crates.io) and so, downstream users may not even know that it exists.

Also, if I'm reading it correctly, the current recommendation is leaning towards committing Cargo.lock into source control.