Rust pkgs with eMudhra's bad certs in webpki-roots

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

We have dozens of Rust packages that pull in the webpki-roots or
webpki-root-certs crates via distinfo, and who knows how long it will
take all the upstreams to publish new versions to update their
Cargo.locks.

How do we deal with this systematically?  Do we have a mechanism to
selectively replace a crate in a Rust package so we can update them
all to 1.0.10 in one swell foop, and pull that all up to the release
branch?