support installing forc plugins from crates.io

[spiral-ladder]

Proposal

allow fetching arbitrary forc plugins from published crates on crates.io.

Problem

Currently we are relying on 1) what is published on our channel TOMLs to allow downloading an entire distributed toolchain and 2) manually downloading from the release through github API itself.

As we've seen from @otrho 's forc-dis, there may be some useful plugins that are optional and may not need to be shipped officially (yet!).

We will probably have to allow this anyway (and other options as suggested in #310, an --ipfs option?) at some point, especially if we want community-built plugins.

Implementation details

I imagine this could be a wrapper around cargo install <BIN> --root <TOOLCHAIN_DIR>. This downloads, for example, forc-dis to the toolchain directory, and does all the linking that makes components/plugins click with fuelup. This could be provided through fuelup component add with a new option --cargo:

fuelup component add --cargo forc-dis

Potential issues

My main concern is that this might make the interaction between cargo and fuelup even more confusing than it already is. It could be better to just not blur the lines (for now?) between the 2 package/toolchain managers even if we're missing some flexibility.

This also adds an implicit dependency on cargo, hence we should be supporting it through an option instead of being a main feature of fuelup - if we want to go with this, we should probably also make sure that users are aware of this implicit dependency through the fuelup book and appropriate warning/failure messages if you run the command without cargo.

Another potential issue is that we would be allowing users to arbitrarily download plugins to their toolchain directories and this could be a potential source of vulnerability since its not in-house code anymore, but then again this problem virtually exists for most executables that we download anyway.

[otrho]

allow fetching arbitrary forc plugins from published crates on crates.io.

Is it not enough to just highlight useful plugins on awesome-fuel or somewhere semi-linked to from our docs and let the user install them?

[spiral-ladder]

That works, but the plugin will be installed under cargo and won't have the benefit of being managed by fuelup. This would mean being able to have separation between your cargo and fuelup related bins (which has been a source of confusion for most), and at large allowing arbitrary plugins to be installed in a toolchain without needing to be indexed by fuelup.

I think this is important if we want to encourage community-built plugins that can be managed by fuelup instead of cargo.