Vetting 3rd party crates for supply-chain-security issues

The Cargo.lock file is updated by many contributors, sometimes a bot?, and there's no record of the 3rd party dependencies having their code reviewed.

This seems risky to me, given how big impact the 3rd party code could have on the compiler and all downstream Rust users. The crates in the lockfile have many owners, some which are not members of rust-lang org. If any of the crates had malware, it could attack rust-lang org infrastructure, computers of core developers, etc. This doesn't require malice from any of the people involved — it could also happen due other security issues like leak of an auth token, or one of crate owners having their machine infected with malware.

Start by reviewing Cargo.lock and its linked commit history to understand how third-party dependencies are currently updated. The issue does not identify an implementation entry point, test, or concrete acceptance criteria, so the desired vetting process and definition of done would need to be established first.