Add support for multiple advisory databases

[Jake-Shadle]

Currently cargo-deny is restricted to using one advisory database at a time via the db-url configuration setting. It would be useful to support multiple databases in parallel, particularly for unmaintained advisories, so that we can point our configuration at our own database while either a PR to the official advisory-db is pending, or just that we might want to be a more aggressive with particular crates compared to the rest of the ecosystem.

[Stupremee]

How would you handle backwards-compatibility if you add this feature?
Just removing the db-url entry and replace it with db-urls (or something similar) doesn't sound like a good idea.

Probably add another db-urls config entry and keep the db-url parameter and the concatenate them both and probably give a warning that db-url is deprecated.

[Jake-Shadle]

That would be an option, as well as allowing either a single string or an array for the db-url field by doing something like https://serde.rs/string-or-struct.html, but I think your option is probably better, I don't think many people override the url to point to something other than the default, so deprecating it it would be fine.