feature: set of trusted crates

[mimoo]

We can't review EVERYTHING + some crates should really be in the stdlib = set of trusted crates.

The question we need to pose is: do we want this set of trusted crates to be public knowledge? Because it'd be much much easier to implement this with a dependencies.toml at the root of diem/diem that lists our set of trusted crates.

This could also be a folder instead (/.dependencies or /.whackadep/dependencies) which would contain files like rand.toml which would contain notes from users on why we should trust this crate. For example:

[[note]]
author = "mimoo"
note = "we trust burntsushi"

What do you think? cc @jnaulty @xvschneider @mickayz @AnomalRoil @metajack