cargo package should warn binary files by default

[upsuper]

I've seen multiple times that some images which is used in README only is included into crate package, e.g. bindgen contains a 1.3MB PNG, and dtoa contains a 68KB PNG.

I believe binary files in general are not useful in packages. They should be excluded or at least warned by default. People should still be able to explicitly specify binary files if necessary, though.

[froydnj]

E.g. this bugzilla patch, produced via cargo-vendor includes rlibs from target/debug/. It would be splendid if we could blacklist such files in cargo package so crates.io packages didn't get so bloated.

[alexcrichton]

Sounds like a good idea to me!

[upsuper]

Another bloating which could be avoidable if we have such warning: dropbox/rust-brotli#8

[link2xt]

Related issue about packaging a binary on purpose: serde-rs/serde#2538

[epage]

Some relevant cargo-deny lints:

https://embarkstudios.github.io/cargo-deny/checks/bans/diags.html#detected-executable

https://embarkstudios.github.io/cargo-deny/checks/bans/diags.html#detected-executable-script