Fix parsing specs from `cargo pkgid`

According to the syntax specifications for pkgid https://doc.rust-lang.org/cargo/reference/pkgid-spec.html,
the name can be separated from the version by either '@' or ':'.
The current version of cargo use @, which the parser wasn't expecting.

Does better validation of package name now, in accordance with https://doc.rust-lang.org/cargo/reference/manifest.html#the-name-field.
This should help catch these sorts of parse errors in the future.

Upgrade dependencies.