Normalize source urls

[Jake-Shadle]

Cargo internally normalizes eg github urls to always strip off the optional .git suffix, as there is no difference between the raw and suffixed url, however, the lockfile and metadata use the url as specified by the user verbatim, which means that urls specified in [sources] must match exactly. We should instead do normalization as well so that the deny config and specification in the user's workspace just have to match on the actual base url, not the entirety.

[senden9]

If we look at https://github.com/rust-lang/cargo/blob/1f6c6bd5e7bbdf596f7e88e6db347af5268ab113/src/cargo/util/canonical_url.rs#L31-L57 we see that cargo does even more normalization.

So do we just want to do the .git stripping or the full normalization dance?