Allow verifying published MSRV

[epage]

Packages can have two MSRVs

• Local development / as a git dependency
• As a registry dependency

For example, if you use workspace inheritance, your local development / git dependency MSRV is 1.64 but your registry dependency MSRV could be lower but you can't verify it. This is because cargo package removes these development-time features.

We could verify the published version of a package if we did cargo package on each package and then verified the .crate files.

[taiki-e]

Seems reasonable to me.