Feedback on `cargo-upgrade` to prepare it for merging

One should never check in a lockfile. I really gotta find the time to write the full-length essay about how bad a practice this is.

(I might even go as far as to say that lockfiles shouldn't exist. I've seen only one or two legitimate uses and it's not clear to me that these are sufficient to justify how easy it is to screw both yourself and all your downstreams over with the mere existence of a lockfile.)