Cargo vendor: add source rewriting for private registries included in…

… deps

In the case where the exact same dependency is supplied by two different registries, Cargo.lock keeps only one. However, in that case, the output of `cargo vendor` contains only the registry from Cargo.lock, which isn't enough to compile with `--offline`.

This commit adds the dependencies' registries of all vendored packages to the output of `cargo vendor`.

src/cargo/ops/vendor.rs

@@ -1,9 +1,10 @@
 use crate::core::shell::Verbosity;
-use crate::core::{GitReference, Package, Workspace};
+use crate::core::{EitherManifest, GitReference, Package, Workspace};
 use crate::ops;
 use crate::sources::path::PathSource;
 use crate::sources::CRATES_IO_REGISTRY;
 use crate::util::cache_lock::CacheLockMode;
+use crate::util::toml::read_manifest;
 use crate::util::{try_canonicalize, CargoResult, GlobalContext};
 use anyhow::{bail, Context as _};
 use cargo_util::{paths, Sha256};
@@ -203,6 +204,13 @@ fn sync(
             id.name().to_string()
         };
 
+        let t = read_manifest(&src.join("Cargo.toml"), id.source_id(), gctx)?;
+        if let EitherManifest::Real(m) = t {
+            for d in m.dependencies() {
+                sources.insert(d.source_id());
+            }
+        }
+
         sources.insert(id.source_id());
         let dst = canonical_destination.join(&dst_name);
         to_remove.remove(&dst);