remove `cargo` dependency

[Marco Ieni]

Motivations

cargo increases the compile time of release-plz.
We only use it to download crates from the registries.

Solution

After reading this docs, I think we can implement the download of the crate by ourselves.

Example code doing this (not sure if they work with private registries):

• https://github.com/Nullus157/cargo-dl
• https://github.com/Xion/cargo-download
• https://github.com/nakabonne/rhack

Things to check:

• can we re-use the cargo cache folder?

• make sure it works with private registries: both sparse and git protocol

• support authentication with cargo login. This is from cargo help login:

  For the default cargo:token credential provider, the token is saved in $CARGO_HOME/credentials.toml.
  CARGO_HOME defaults to .cargo in your home directory.
  
  If a registry has a credential-provider specified, it will be used.
  Otherwise, the providers from the config value registry.global-credential-providers will be attempted, starting from the end of the list.
  

Alternatives

It would be much better if cargo offered this out of the box. I.e. cargo download my-crate.
We could open an RFC to add this functionality to cargo.
However, this might take a lot of time until we see it implemented.

Note

I'm not an expert on this, so I'm happy to discuss this with somebody with more knowledge about cargo. Feel free to challenge me on this decision :)