Please make the exact crate dependency set of published prebuilt binaries reproducible (Cargo.lock / cargo-auditable / bundled third-party notices) #1200

Hi, thanks for maintaining node-rs!

We ship @node-rs/argon2 (specifically the -darwin-arm64 prebuilt) inside a desktop
application, and as part of open-source license compliance we need to list the copyright
and license notices of all Rust crates statically linked into the published .node binary.

Currently this is hard to do accurately, because:

• The repository does not commit Cargo.lock (and CI does not build with --locked),
  so the exact transitive crate versions used for a given published binary are not
  recorded anywhere.
• The npm packages have provenance attestations (thanks for that!), which pins the source
  commit — but regenerating a lockfile from that commit today resolves different versions
  than the ones actually linked (e.g. the published argon2-darwin-arm64@2.0.2 binary
  embeds napi-3.0.0-alpha.22, while a fresh resolution picks a much newer napi).
• The prebuilt npm package contains only the project's own LICENSE, not the third-party
  crate notices.

We completely understand if you prefer to keep Cargo.lock out of version control — that
has long been common practice for library crates, and we're not questioning it. Our ask is
only about the published prebuilt binaries: any record of the dependency set that went into
them (in whatever form is most convenient for you) would be a big help for downstream
license compliance. (For reference, Cargo's defaults changed in August 2023 —
rust-lang/cargo#12382 — to check in Cargo.lock by default; but every option below works
equally well for us, and the last one avoids committing a lockfile entirely.)

Would you consider any of the following? Any one of them would make downstream compliance
much more reliable:

1. Commit Cargo.lock and build releases with --locked (also improves build
   reproducibility), or
2. Build release binaries with cargo auditable,
   which embeds the exact dependency list into the binary at negligible size cost
   (this also enables cargo audit bin for security scanning), or
3. Bundle a generated third-party license file (e.g. via
   cargo-about) in the prebuilt npm packages, or
4. If you'd rather not commit a lockfile at all: generate one in CI, build with --locked,
   and attach that Cargo.lock as a release/CI artifact — that equally records what shipped.

Happy to provide more details about our use case if helpful. Thanks!