Modifications in line with latest cargo vendor tool

[Firstyear]

Cargo vendor has been rewritten in rust and now absorbs the functionality of cargo-audit in a way that it can not be bypassed.

As a result the strict cargo audit check is now not needed as it's enforced on packages that vendor.

Additionally some of the semantics around cargo update have changed, which this now reflects.

[jubalh]

@dirkmueller could you maybe have a look at this one? :)

[uncomfyhalomacro]

bump @dirkmueller

[xtexChooser]

plsssss merge thissss