Add structured output flag

[Jake-Shadle]

Right now we just spit out (almost) all the diagnostics to stderr, which is fine for running locally as a user, but when running in CI, it would be good to additionally support structured output, that can then be consumed more easily by other tools etc to eg. add annotations in gihub actions. Presumably the structured output would just be JSON.

See EmbarkStudios/cargo-deny-action#10

[luser]

Our security folks are using cargo audit --json for automated reporting, but I switched our main CI to use cargo deny. It'd be nice if we had JSON output so we were using the same tool in both places.

[Jake-Shadle]

I am going to work on this today and see about using it in the action to resolve EmbarkStudios/cargo-deny-action#10. Out of curiosity, do you use the action, or do you run it in a different CI? We use Buildkite for our internal projects so I could add a guide in the docs about how to use the JSON output for reporting in CI, generally.

[luser]

We're running our CI in CircleCI.

[tarcieri]

The core reporting functionality in the rustsec constructs a serde-serializable Report struct:

https://docs.rs/rustsec/latest/rustsec/report/struct.Report.html