Allow using Cargo-as-a-library with gix's reqwest backend

[dtolnay]

What does this PR try to resolve?

Unconditionally enabling "blocking-http-transport-curl" made the cargo library incompatible with crates that prefer reqwest. An example being the rustsec crate with git support:

• https://github.com/rustsec/rustsec/blob/rustsec/v0.30.2/rustsec/Cargo.toml#L45-L47
• https://github.com/rustsec/rustsec/blob/rustsec/v0.30.2/rustsec/Cargo.toml#L34
• https://github.com/EmbarkStudios/tame-index/blob/0.21.0/Cargo.toml#L14-L17

Having cargo and rustsec in the same dependency graph makes gix-transport fail to compile.

[dependencies]
cargo = "0.88.0"
rustsec = "0.30.2"

error[E0428]: the name `Impl` is defined multiple times
   --> $CARGO_HOME/registry/src/index.crates.io-1949cf8c6b5b557f/gix-transport-0.45.0/src/client/blocking_io/http/mod.rs:220:1
    |
217 | pub type Impl = curl::Curl;
    | --------------------------- previous definition of the type `Impl` here
...
220 | pub type Impl = reqwest::Remote;
    | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `Impl` redefined here
    |
    = note: `Impl` must be defined only once in the type namespace of this module

error: Cannot set both 'http-client-reqwest' and 'http-client-curl' features as they are mutually exclusive
  --> $CARGO_HOME/registry/src/index.crates.io-1949cf8c6b5b557f/gix-transport-0.45.0/src/client/blocking_io/http/mod.rs:26:1
   |
26 | compile_error!("Cannot set both 'http-client-reqwest' and 'http-client-curl' features as they are mutually exclusive");
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

After this PR, dependency graphs that prefer reqwest can switch to Cargo's http-transport-reqwest feature.

[dependencies]
cargo = { default-features = false, features = ["http-transport-reqwest"] }
rustsec = "0.30.2"

Cargo will continue to have a direct dependency on curl, but HTTP operations performed through gix will use reqwest. This means both curl's HTTP implementation and reqwest's HTTP implementation will be linked. This is still much better than the only existing solution, which is that you must pick versions of cargo and other dependency (rustsec) which depend on semver-incompatible versions of gix, causing 2 entire versions of gix to be linked, in order to sidestep the mutually exclusive features being enabled on the same version of gix. Gix version numbers advance rapidly enough that this is often possible, but sometimes (like right now) you would be unable to use the most recent published release of cargo.

How to test and review this PR?

• cargo check --lib
• cargo check --lib --no-default-features --features http-transport-reqwest

Also tested by backporting this commit onto #15391's base commit (i.e. when gix 0.70 was used) to ensure a conflict with rustsec's gix dependency, and successfully building the following project.

[package]
name = "repro"
version = "0.0.0"
edition = "2024"
publish = false

[dependencies]
cargo = { path = "../cargo", default-features = false, features = ["http-transport-reqwest"] }
rustsec = "0.30.2"

[rustbot]

r? @weihanglo

rustbot has assigned @weihanglo.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

[weihanglo]

I don't have any objection to this. Let me bring it to the Cargo team's meeting.

[weihanglo]

The Cargo team has discussed this today during the weekly meeting, and we agree this should be made optional.
Adding the feature to the default feature is fine as well, since cargo the library crate bumps its major version in each release.

In the future, we would like to see reqwest or other HTTP backends being options for the entire Cargo, not just for gix.

Thank you for the contribution. Could you rebase onto master so we can possibly merge it?

[dtolnay]

CI was trying to run cargo semver-checks check-release --workspace which runs (effectively) cargo check --all-features --lib, causing both gix backends to be enabled, which is an error. I added a workaround but not sure if it is the best one.

[weihanglo]

What about doing this in xtask-bump-check?

    let mut cmd = ProcessBuilder::new("cargo");
    cmd.arg("semver-checks")
        .arg("check-release")
        .arg("--workspace")
        .args(&["--exclude", "cargo"]);

    gctx.shell().status("Running", &cmd)?;
    cmd.exec()?;

    // Cargo has multully-exclusive features for different HTTP backends,
    // so need to pass `--features` separately
    let mut cmd = ProcessBuilder::new("cargo");
    cmd.arg("semver-checks")
        .arg("check-release")
        .args(&["--package", "cargo"])
        .args(&["--feature", "all-static"]);

    gctx.shell().status("Running", &cmd)?;
    cmd.exec()?;

[weihanglo]

Thank you! Would you mind cleaning up some intermediate and revert commits?