Generate checksums for vendored git archives

[snoopuppy582]

Summary

--git creates a .crate archive locally, but the corresponding package has no checksum in Cargo.lock. The generated index entry therefore uses an empty cksum, leaving Cargo without an archive checksum to verify.

This change computes SHA-256 after each git archive is created and writes that value to the index entry. Registry packages continue to use their resolved lockfile checksums, so existing registry downloads do not receive an additional hashing pass.

This is the companion change for rust-lang/cargo#10939 and rust-lang/cargo#17228. It lets Cargo keep git entries checksumless in Cargo.lock while verifying the replacement archive against the local-registry index.

Tests

The existing git_dependency test now checks that the index checksum matches the generated .crate file exactly.

• cargo test --all --locked
• cargo clippy --bin cargo-local-registry -- -D warnings
• end-to-end source replacement and same-version git revision update with the paired Cargo change