Migrate crates_io_tarball to async/await

[eth3lbert]

This PR migrates crates_io_tarball to async/await, allowing us to remove the spawn_blocking() call in the publish endpoint :)

[codecov]

Codecov Report

Attention: Patch coverage is 75.34247% with 18 lines in your changes missing coverage. Please review.

Project coverage is 89.49%. Comparing base (db4f944) to head (67b5de0).
Report is 12 commits behind head on main.

Files with missing lines	Patch %	Lines
...tes/crates_io_tarball/examples/check_all_crates.rs	0.00%	13 Missing ⚠️
crates/crates_io_tarball/examples/read_file.rs	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10064      +/-   ##
==========================================
- Coverage   89.51%   89.49%   -0.02%     
==========================================
  Files         295      295              
  Lines       31195    31233      +38     
==========================================
+ Hits        27924    27953      +29     
- Misses       3271     3280       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

---

🚨 Try these New Features:

• Flaky Tests Detection - Detect and resolve failed and flaky tests
• JS Bundle Analysis - Avoid shipping oversized bundles

[Turbo87]

I assume this is a fork and there is a reason for not using the original?

[eth3lbert]

Since the original tokio-tar seems unmaintained, and I know it's used by uv and has been reviewed!

[Turbo87]

I know it's used by uv and has been reviewed!

ah, perfect! that's roughly what I wanted to hear :D

[Turbo87]

LGTM! nice work :)

[Turbo87]

rebased this on top of #10068 to fix the cargo-deny issue (i.e. rustls vulnerability)