Vendor crates by extracting crate files

[luser]

We've run afoul of rust-lang/cargo#5956 many times in Firefox development, and until someone figures out a way to prevent things from making changes to crate sources in the local registry, I think vendoring crates by directly extracting their crate files would be less error-prone.

Looking at the cargo source I don't think this is straightforward to do with the APIs cargo provides, unfortunately. Perhaps the closest thing to do would be to collect the set of packages, then remove those package directories, then re-run the resolution -> package get loop to force cargo to unpack fresh copies of each crate before vendoring.

[alexcrichton]

Forcing Cargo to unpack sounds dangerously plausible! It's not compatible with concurrent invocations of Cargo but I think that's fine