Can we report unmaintained and replacement status on `cargo upgrade`?

[epage]

rustsec tracks maintenance status and replacements. Suggesting alternative upgrade paths could be a help for users.

[ArekPiekarz]

I think reporting maintenance status would duplicate functionality of cargo-audit.

[epage]

Or framed another way, it would integrate some of cargo-audit into the users workflow.

This issue specifically calls out maintenance status and replacements, cases where the "upgrade" path is to switch packages and we can't do that for the user, so we instead tell them how. I would love it if users of structopt got a message saying that they should instead use clap. Instead we have to plaster it all over the structopt repo and over a year later we still have people who didn't know of the transition (unfortunately, this still won't work for the structopt case because we haven't officially declared it as unmaintained)