use external time crate
put Cargo.lock under source control

Because binaries should put their Cargo.lock under source control.