Add `cargo` CVEs 2022-36113 & 2022-36114

Background

Cargo has new CVEs: https://blog.rust-lang.org/2022/09/14/cargo-cves.html

• CVE-2022-36113 - GHSA-rfj2-q3h3-hm5j
• CVE-2022-36114 - GHSA-2hvr-h6gw-qrxp
• https://github.com/rust-lang/cargo/commit/d1f9553c825f6d7481453be8d58d0e7f117988a7
• https://github.com/rust-lang/cargo/commit/d87d57dbbda61754f4fab0f329a7ac520e062c46

There was a fix here: https://github.com/rust-lang/cargo/pull/11088 that targeted beta five days ago

It is possible there is a backport to 1.64.0 release

One problem is the GHSA went out before there was actionable fix and GHSA also targeted this against the cargo crate itself

Cargo is also used as a library so beyond the cargo binary itself GHSA targets the library

Real question here is..

Beyond the usual rust release CVEs e.g. cargo binary -

We hold should maybe add RustSec light up the cargo crate as a library re: CVE's ?

I haven't had time to go dig deep on this yet but if someone wants to take a stab at it..

Ref: https://github.com/rust-lang/wg-security-response/issues/10 - best to hold up merging for actionable fix maybe

Review the Cargo CVE and GHSA links, the Rust blog post, the two Cargo commits, and PR #11088, then check the RustSec security-response issue referenced in the report. Determine whether the vulnerabilities should be represented for the cargo binary, the cargo library crate, or both; done means the applicable advisory entries and affected versions are clearly established.