cargo-deny 0.18.4

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

release notes

### Added
- [PR#779](https://github.com/EmbarkStudios/cargo-deny/pull/779) added the `--metadata-path` argument to use a cargo metadata JSON file instead of calling cargo metadata, resolving [#777](https://github.com/EmbarkStudios/cargo-deny/issues/777).
- [PR#782](https://github.com/EmbarkStudios/cargo-deny/pull/782) added `sources.unused-allow-source` to allow configuration of the lint level when a source is allowed but not used by any crate in the graph, closing [#781](https://github.com/EmbarkStudios/cargo-deny/issues/781).
Changed

PR#786 changed the license check output. / is no longer corrected to OR, and if the license expression is found in the package's manifest, that span is used in diagnostic messages instead of the synthesized manifest.

Fixed

PR#786 resolved #784 by updating spdx to a new version that forces all GNU licenses to be exactly equal when comparing license expressions to licensee expressions, which is incredibly pedantic, but means the license comparison is entirely in the hands of the user so that I no longer have to deal with GNU licenses.

View the full release notes at https://github.com/EmbarkStudios/cargo-deny/releases/tag/0.18.4.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.