Offline mode

Thanks for a great project!

It looks like cargo audit doesn't honor the offline flag and always try to fetch crates.io. On the other hand it continues running successfully after failing so I think it's an unnecessary operation?

$ CARGO_NET_OFFLINE=false cargo audit --no-fetch --db /path/to/rustsec-advisory-database

      Loaded 85 security advisories (from /path/to/rustsec-advisory-database)
    Updating crates.io index

warning: couldn't update crates.io index: registry: failed to connect to github.com: Network is unreachable; class=Os (2)

Scanning Cargo.lock for vulnerabilities (245 crate dependencies)

     Success No vulnerable packages found

This is only a minor nuisance for me in my environment where there's no internet connection. I think this is a common situation in many CI systems where all sources are vendored and build offline. But things still work so other than a slight delay things work well. Nothing more than a slight eyesore!

Start by reproducing the cargo audit command with --no-fetch, --db, and the offline environment described in the report, then trace how those options affect the crates.io index update. Done means the audit scans Cargo.lock successfully without attempting an unnecessary network fetch or emitting the connection warning.