Add lint(s) for git sources

[Jake-Shadle]

When using a git repository as a crate source, by default it will just pull the HEAD of the default branch from the URL given whenever the lockfile is updated, which is basically the same as having a wildcard dependency on the crate, which we recently added a check for, except it's even worse since it can pull code that hasn't even been released yet.

Cargo allows specifying branch, tag, and rev to give more control over what code to pull from the git repo, but of these, really only rev is a precise identifier, as branch has similar problems to the default behavior, as well as tag, as tags can be moved to different commits between lockfile updates, though this is a lesser concern.

For our projects we mandate that any git dependencies use a rev specifier, both for sanity, as well as to get the most benefit from cargo-fetcher, but we don't actually lint for this, and would fit in nicely with the existing sources check.

[8573]

When using a git repository as a crate source, by default it will just pull the HEAD of the default branch from the URL given […]

Is this true yet? To my limited understanding, Cargo, for now, defaults to using master and doesn't check what the default branch actually is: see, e.g., rust-lang/cargo#8364, rust-lang/cargo#8522. I'm not sure whether those patches have been released, but I would imagine there would have been a note on the Rust blog if they had.

[Jake-Shadle]

Yah you're right, I meant default more as master for now, but with cargo adding in default branch detection in the future.