After a quick search, it seems the answer is no for the current version of Cargo, so I posted this question on IRLO.
Since I need to use cksumvfs—a feature not yet officially supported by rusqlite—I created a fork of rusqlite and tried to add the Git repository URL of that fork to the project’s dependencies. However, since rusqlite is a relatively large project, Cargo appears to fetch the entire history, which significantly slows down the first compilation. This is just a repository with a history of tens of megabytes in size—I can’t even imagine how slow and space-consuming it would be if the repository were hundreds of megabytes or even gigabytes in size. Therefore, using --depth 1 or fetching only the specific commit needed might be a better option.
Small correction: originally we were limited by a git hosting service advising us against it because of the server load involved with different aspects of the protocol. They no longer raise that objection and so it has just been libgit2.
On the flip side, git itself (almost certainly with GitHub's nudging) has shifted towards preferring partial clones over shallow clones, at least if you're going to keep using the repository. (I don't know how Cargo handles multiple dependencies on the same repository across space/packages or time/updates.)
BTW I noticed that even when I use .cargo/config.toml to patch the Git URL to a local path, Cargo still always fetches from the Git URL (even though it actually compiles the local code). Is this an expected behavior? Is there a way to force Cargo to use the local path?