allow the user to add "unnecessary" criteria to an audit

**PROBABLY NOT NEEDED FOR MVP**

If cargo-vet says you only need safe-to-run but you decide to audit for safe-to-deploy anyway that's *good* and should be encouraged/allowed. Ultimately the UI will need two bits of state per criteria:

* Did cargo-vet recommend this?
* Did the user audit for this?

This also necessitates "showing" non-recommended criteria somehow (maybe collapsed? in a sidebar?).

The "shields" in the sidebar for whether you've done something could also potentially be more subtle:

* nothing done (no shield)
* you did something, but not what we asked (yellow?)
* you did what we asked (green)
* you went above and beyond (blue? purple? gold star?)

If you try to submit with yellow shields there should probably be an "are you sure?" prompt.

The issue names no files, tests, or entry points. Start by locating the audit-criteria UI and cargo-vet recommendation flow, then clarify the state model and submission behavior; done requires an agreed design for optional criteria, shield states, and the warning prompt.

Written by the indexing model from the issue text.