Allow using Cargo-as-a-library with gix's reqwest backend

[dtolnay]

What does this PR try to resolve?

Unconditionally enabling "blocking-http-transport-curl" made the cargo library incompatible with crates that prefer reqwest. An example being the rustsec crate with git support:

• https://github.com/rustsec/rustsec/blob/rustsec/v0.30.2/rustsec/Cargo.toml#L45-L47
• https://github.com/rustsec/rustsec/blob/rustsec/v0.30.2/rustsec/Cargo.toml#L34
• https://github.com/EmbarkStudios/tame-index/blob/0.21.0/Cargo.toml#L14-L17

Having cargo and rustsec in the same dependency graph makes gix-transport fail to compile.

[dependencies]
cargo = "0.88.0"
rustsec = "0.30.2"

error[E0428]: the name `Impl` is defined multiple times
   --> $CARGO_HOME/registry/src/index.crates.io-1949cf8c6b5b557f/gix-transport-0.45.0/src/client/blocking_io/http/mod.rs:220:1
    |
217 | pub type Impl = curl::Curl;
    | --------------------------- previous definition of the type `Impl` here
...
220 | pub type Impl = reqwest::Remote;
    | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `Impl` redefined here
    |
    = note: `Impl` must be defined only once in the type namespace of this module

error: Cannot set both 'http-client-reqwest' and 'http-client-curl' features as they are mutually exclusive
  --> $CARGO_HOME/registry/src/index.crates.io-1949cf8c6b5b557f/gix-transport-0.45.0/src/client/blocking_io/http/mod.rs:26:1
   |
26 | compile_error!("Cannot set both 'http-client-reqwest' and 'http-client-curl' features as they are mutually exclusive");
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

After this PR, dependency graphs that prefer reqwest can switch to Cargo's http-transport-reqwest feature.

[dependencies]
cargo = { default-features = false, features = ["http-transport-reqwest"] }
rustsec = "0.30.2"

Cargo will continue to have a direct dependency on curl, but HTTP operations performed through gix will use reqwest. This means both curl's HTTP implementation and reqwest's HTTP implementation will be linked. This is still much better than the only existing solution, which is that you must pick versions of cargo and other dependency (rustsec) which depend on semver-incompatible versions of gix, causing 2 entire versions of gix to be linked, in order to sidestep the mutually exclusive features being enabled on the same version of gix. Gix version numbers advance rapidly enough that this is often possible, but sometimes (like right now) you would be unable to use the most recent published release of cargo.

How to test and review this PR?

• cargo check --lib
• cargo check --lib --no-default-features --features http-transport-reqwest

Also tested by backporting this commit onto #15391's base commit (i.e. when gix 0.70 was used) to ensure a conflict with rustsec's gix dependency, and successfully building the following project.

[package]
name = "repro"
version = "0.0.0"
edition = "2024"
publish = false

[dependencies]
cargo = { path = "../cargo", default-features = false, features = ["http-transport-reqwest"] }
rustsec = "0.30.2"

[rustbot]

r? @weihanglo

rustbot has assigned @weihanglo.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer