temp/hkdm: work around weird cargo fetch bug

Discussed in devel with @craftyguy , for some reason cargo fetch tries to git clone --bare the whole crates.io repository and hits some weird OOM error in bpo. We are able to reproduce this locally in a pmbootstrap armv7 chroot.

workaround this by vendoring all the dependencies and including them in the hkdm source tarball, then we can avoid cargo fetch and run cargo build --offline to use them.