Identify crates using SemVer and crates.io

[cdstanford]

In audit files:

• For crates which appear on https://crates.io/, we should identify the crate using the crate name and semantic version (e.g. syn v2.0.70), and the source code hash as provided by crates.io.

• For crates which are local, we should identify the crate using the path to the crate as well as the source code hash. It may be possible to add some kind of public identifier in some cases (e.g. a repository link) if the audit needs to be shared.