Support for running without cargo.exe installed

[repi]

Currently as we use cargo_metadata crate the user running cargo-deny also have to have the full Cargo toolchain installed, in other words: cargo-deny is not a fully standalone executable.

This is ok and good for the default use case as it is very likely a user that is interested in using cargo-deny also have Cargo and Rust installed :)

But for CI and/or minimal docker images it would be nice if we had an optional feature flag for using the cargo crate and output_metadata directly on it instead of invoking cargo.exe. Can still take the .json output and feed it into cargo_metadata to leave the rest of the code and parsing unchanged.

[Jake-Shadle]

I now know what problems you ran into in test action. 😉

[repi]

Spy! :)

Installing Cargo and getting it in the environment properly turned out to be harder than expected, and way fatter image, and ideally unnecessary.