In theory this advisory should trigger this feature of `cargo-audit`
which checks for advisories filed against the `rustsec` crate:
https://github.com/RustSec/cargo-audit/blob/783f221/src/auditor.rs#L178-L199
After merging, I will test with an older `cargo-audit` version to see if
it has the intended effect.
