Update petgraph to 0.7.1

[musicinmybrain]

See https://github.com/petgraph/petgraph/blob/petgraph%40v0.7.1/RELEASES.rst. This is a SemVer-incompatible update only because petgraph’s exposed dependency fixedbitset was updated SemVer-incompatibly, but rustsec’s use of the petgraph APIs is straightforward, and no code changes appear to be necessary:

$ rg petgraph::
cargo-lock/src/dependency/tree.rs
185:        use petgraph::visit::EdgeRef;

cargo-lock/src/dependency/graph.rs
3:pub use petgraph::{graph::NodeIndex, EdgeDirection};
8:pub type Graph = petgraph::graph::Graph<Package, Dependency>;

cargo-lock/src/bin/cargo-lock/main.rs
13:use petgraph::graph::NodeIndex;

Tested with cargo test --workspace -- --skip lint_advisory_db.

[tarcieri]

Note: since petgraph is part of cargo-lock's public API, this is unfortunately a SemVer breaking change there as well

[djc]

@tarcieri how careful do we have to be about semver-incompatible changes for these crates? Are they widely used as libraries? Should we just move forward with this and bump the cargo-lock version to 11?

[tarcieri]

I’d consider this a breaking change, yes.

Before we cut another release though, we should address #1323 which needs breaking changes to fix I believe

[djc]

Upgraded to 0.8 in #1424.