Dependency confusion attack — may be applicable to alternative registries

[2e71828]

@kornel

I don't know if Cargo could do better here. Maybe it could warn or require disambiguation when told to fetch a dependency from a public repository when a private repository has a crate with the same name?

Can the crates.io registry be disabled or made non-default? Companies that want to audit their dependencies could then mirror the crates that have been manually approved, and any confusion attack would need to survive their audit process.