Track fixes for cargo CVEs

The experimental version 0.17.0-1~exp1 should have been the first
version which contained a fixed version of the embedded libgit2 copy.
Then various iterations came to depend on system libs, then re-embed,
then switch again to not the embedded copy.

Thus please double-check this update.