`multiple_crate_versions` lint may not use vendored crates

Summary

When using the multiple_crate_versions lint, clippy will call cargo metadata https://github.com/rust-lang/rust-clippy/blob/4eb4192ae3b31929986f7bc67df812b6384f9510/clippy_lints/src/cargo/mod.rs#L209.

If cargo clippy was called with --config args, those args are not passed to the cargo metadata call. If those --config args contain the location of vendored crates, cargo metadata will not know to use the vendored directories.

Reproducer

Here is some code to setup a repro (tested on Linux)

cargo new cargoclippybug
cd cargoclippybug
cargo add clap
cargo build
cargo vendor
cargo clean

And here is code to repro (you should be able to run this over and over).

cargo clean
CARGO_HOME=$(mktemp -d)  cargo clippy --config "source.crates-io.replace-with=\"vendored-sources\"" --config "source.vendored-sources.directory=\"vendor\"" -- -D clippy::multiple_crate_versions

I expected to see this happen: The call to cargo clippy should not need network access

Instead, this happened: I see network activity. I can see this by using strace.

cargo clean
CARGO_HOME=$(mktemp -d)  strace -fe trace=network -o network.log cargo clippy --config "source.crates-io.replace-with=\"vendored-sources\"" --config "source.vendored-sources.directory=\"vendor\"" -- -D clippy::multiple_crate_versions

Version

rustc 1.73.0 (cc66ad468 2023-10-03)
binary: rustc
commit-hash: cc66ad468955717ab92600c770da8c1601a4ff33
commit-date: 2023-10-03
host: x86_64-unknown-linux-gnu
release: 1.73.0
LLVM version: 17.0.2

Additional Labels

No response

Start in clippy_lints/src/cargo/mod.rs at the cargo metadata call linked in the issue, then reproduce with the provided cargo clippy command and vendored source configuration. Trace how the original --config arguments reach Clippy and compare that with the metadata invocation; done means the lint works with vendored crates without network access.