fix: update mtime for generated files after unpacking

[weihanglo]

What does this PR try to resolve?

This is the unpacking half of #16237

Updating mtime for all files might not be worthy as crate published
after 1.54 should all have the deterministic mtime for non-generated
files, except those did manual upload.

This patch is aimed at
fixing the "regression" of vendor direct extraction,
rather than a complete fix of the non-deterministic mtime.
Also there are workarounds,
so the workflow is not completely blocked.

Fixes #16237

How to test and review this PR?

Since Cargo had a couple CVEs around tar and unpack,
I separate the mtime update logic from the main unpack logic,
so that each function's intent is clearer.
Hope it won't introduce new vulnerability

[rustbot]

r? @epage

rustbot has assigned @epage.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

[weihanglo]

I love how the new typo= job show typos:

 Warning: "determinisitic" should be "deterministic".
error: `determinisitic` should be `deterministic`
     ╭▸ ./src/cargo/sources/registry/mod.rs:1127:44
     │
1127 │             tracing::trace!("failed to set determinisitic mtime for {path:?}: {e}");
     ╰╴                           

[epage]

I love how the new typo= job show typos:

 Warning: "determinisitic" should be "deterministic".
error: `determinisitic` should be `deterministic`
     ╭▸ ./src/cargo/sources/registry/mod.rs:1127:44
     │
1127 │             tracing::trace!("failed to set determinisitic mtime for {path:?}: {e}");
     ╰╴                           

Except why isn't that highlighting the typos span?

[weihanglo]

I love how the new typo= job show typos:

 Warning: "determinisitic" should be "deterministic".
error: `determinisitic` should be `deterministic`
     ╭▸ ./src/cargo/sources/registry/mod.rs:1127:44
     │
1127 │             tracing::trace!("failed to set determinisitic mtime for {path:?}: {e}");
     ╰╴                           

Except why isn't that highlighting the typos span?

Because I failed to copy that 😆. Here is the right diagnostic:

 Warning: "determinisitic" should be "deterministic".
error: `determinisitic` should be `deterministic`
     ╭▸ ./src/cargo/sources/registry/mod.rs:1127:44
     │
1127 │             tracing::trace!("failed to set determinisitic mtime for {path:?}: {e}");
     ╰╴                                           ━━━━━━━━━━━━━━