Hermetic build mode

Meta: this should be an RFC, but I am unlikely to write one soon. Creating mostly to coordinate discussion.

Problem: today, it's possible to get byte-for-byte identical results compilation results (especially with wasm), but it is impossible to guarantee, because ambient environment (~/.cargo/config, CARGO_HOME, etc) can influence the build. That is, builds are reproducible, but are not hermetic. As a specific example, if I publish a wasm project with Cargo.lock and rust-toolchain.toml, folks running cargo build will generally get the same results, unless someone has RUSTFLAGS set.

Solution: add a mechanism to Cargo to out-out of ambient environment. Strawman proposal -- when --hermetic flag is passed, cargo guarantees that the builds are only affected by the contents of the current working directory.

I don't know an exhaustive list of things that hypothetical --hermetic should forbid, but here are some candidates:

• access to .cargo/config outside of the current directory
• access to env vars like RUSTFLAGS, unless explicitly opted into (a-la --hermetic --allow-env RUSTFLAGS)
• access to PATH? This intersects with rustup. compiler version obviously affects the results, and we need compiler, so PATH is importaet. Perhaps printing rustc -vv during hermetic build is the way to go?
• --hermetic should imply --locked (valid lockfile)
• --hermetic should not imply --frozen. That is, Cargo should be able to fetch sources from the internet (and uses CARGO_HOME for caches), as long as it guarantees that the result is reproducible.

A related feature is https://github.com/rust-lang/cargo/pull/7894, #7887. It allows to control .cargo/config specifically. I, however, feel that we want to make a more specific promise about properties (hermeticity), and tread config handling as an implementation detail.

cc @jsgf

Start by reading the issue's proposed Cargo --hermetic behavior and the related pull request #7894 and issue #7887. The scope is not yet defined: an RFC would need to establish which ambient configuration and environment inputs are excluded or explicitly allowed, and what reproducibility guarantee counts as done.