fix: include a virtual workspace's root Cargo.toml in the cache key (#395)

In a virtual workspace the root `Cargo.toml` is not a package, so the cache key hashed only the
members' manifests and left out the root's `[profile]`, `[patch]` and `[workspace.dependencies]`
(#268). Editing one of those, such as a `[profile.dev]` opt-level, kept the same key: every run
restored the stale cache as an exact hit, rebuilt what the edit invalidated, and saved nothing, so
the rebuild repeated on every run until something else changed the key.

This change hashes the root manifest of the workspace `cargo metadata` reports, along with its
members' manifests. It ignores `workspace.package.version` and the paths and versions of path
dependencies in `[workspace.dependencies]`, as it already does for members, so a release version
bump still keeps the key. It also reads `Cargo.lock` from that root, so a `workspaces` entry that
points at a member directory now hashes the lockfile that builds it. A workspace whose root is a
package keeps its key, and a virtual workspace gets a new one once.

README.md

@@ -147,7 +147,7 @@ This cache is automatically keyed by:
   available),
 - the following values, if `add-rust-environment-hash-key` is `"true"`:
   - the value of some compiler-specific environment variables (eg. RUSTFLAGS, etc), and
-  - a hash of all `Cargo.lock` / `Cargo.toml` files found anywhere in the repository (if present).
+  - a hash of the workspace's `Cargo.lock` and of the `Cargo.toml` of the workspace root and every workspace member (if present).
   - a hash of all `rust-toolchain` / `rust-toolchain.toml` files in the root of the repository (if present).
   - a hash of all `.cargo/config.toml` files in the root of the repository (if present).