Ponder including `Cargo.lock` in version control and releases

Hi!

I was wondering if you ever considered including a `Cargo.lock` file in your repository and releases? There are pros and cons to doing that, as described in [1], but it helps a lot in getting reproducible builds. It would allow me to move forward with making the Quiche package in Arch Linux [2] reproducible, for example.

[1]: https://doc.rust-lang.org/nightly/cargo/faq.html#why-have-cargolock-in-version-control
[2]: https://archlinux.org/packages/extra/x86_64/quiche/