Define workflow for verifying MSRV for `[lib]`s where version reqs support a range of MSRV

[epage]

[lib]-only crates generally do not maintain a Cargo.lock file which makes verifying MSRV difficult because a dependency version requirement might cover a range of MSRVs.

Case studies

• Clap's MSRV checks broke (and many dependent crate's CIs broken) when bitflags updated its MSRV
  • https://github.com/clap-rs/clap/issues/2691
  • https://github.com/clap-rs/clap/issues/2734
  • https://github.com/clap-rs/clap/issues/2735
• To prevent that scenario, Nom constrained the upper bound of their version req, breaking other people's builds

As far as I'm aware, the only solution I know for this is to keep a Cargo.lock.msrv and to copy it over in CI. cargo-msrv verify natively recognizing this pattern and documenting it would be one solution.

The ideal long term solutions are

• -Z minimal-versions that only does minimal versions for direct dependencies (see ehuss's comment) (only a partial solution)
• Cargo's resolver to take MSRV into account

(somewhat related to #117)

[foresterre]

Excellent suggestion, thanks for opening an issue! I'll have a proper look at this soon.