+++ This bug was initially created as a clone of Bug #1628852 +++

A number of times I've seen stuff (rust crate updates) get landed in such a way that somebody who checks out the repo and runs ./mach vendor rust ends up with a dirty tree. Recent examples are here and here. I think we should enforce the fact that ./mach vendor rust should produce zero changes on a clean tree, because otherwise it can complicate things for others trying to do crate updates.

I don't know if it would be better to do this as a lint on phabricator or a job in CI or what, but it should probably make heavy use of network caching because running ./mach vendor rust on every push will trigger a lot of network activity.

Also note that different versions of cargo and/or cargo-vendor may have differences in behaviour, so there should be a "blessed" version that people can use to match what happens in CI.

Some context: bug 1628852 evolved towards having infrastructure that would generate the vendoring patch from Cargo.toml/Cargo.lock changes. I'm not sure we'll eventually do that, but the original problem still exists, and currently third_party/rust/mp4parse is not idempotent.

Set release status flags based on info from the regressing bug 1848033

https://hg.mozilla.org/mozilla-central/rev/a9e4cf5908c0