Always generate a lockfile with dev-dependencies

Previously an invocation of `cargo build` would generate a lockfile *without*
dev dependencies, but an invocation of `cargo test` would generate a lockfile
*with* dependencies. This causes odd problems and diffs with the lockfile.

This commit switches the resolve-to-be-a-lockfile to using all dependencies of a
package, while the resolve-to-be-compiled continues to use just the dependencies
needed for the current build.
auto merge of #389 : alexcrichton/cargo/dev-dependency-lockfile, r=wycats

Previously an invocation of `cargo build` would generate a lockfile *without*
dev dependencies, but an invocation of `cargo test` would generate a lockfile
*with* dependencies. This causes odd problems and diffs with the lockfile.

This commit switches the resolve-to-be-a-lockfile to using all dependencies of a
package, while the resolve-to-be-compiled continues to use just the dependencies
needed for the current build.
Factor in .gitignore for build cmd freshness

When testing the freshness of a build command, the fingerprint of an entire
package is generated. The current method of fingerprinting a path source is to
just stat() the entire tree and look at mtimes. This works fine when the build
command places *all* output in the build directory.

Some systems, like autotools, place *most* output in the build directory and
some output in the source directory, however (see spidermonkey). In this case
the coarse-grained "consider all files in a directory as input" is too painful
for the build command as the package will forever be rebuilt.

This commit adds support for filtering the list of files in a directory
considered to be part of a package by using `git ls-files`. This git-specific
logic can be extended to other VCSs when cargo grows support for them.

Closes #379
Add an exclude key to the manifest

This key is used to help determine the set of input files for a package. The
normal method (via walking or git ls-files) is filtered via all the patterns
provided in `exclude` of the project section.

The toml key is a string array corresponding to a set of glob patterns according
to the syntax of libglob (provided in the standard distribution). The set of
files normally found will be filtered by each pattern, and if any pattern
matches then the path is excluded.

This will later on be used for `cargo package` when generating a tarball to get
uploaded.
Preserve $OUT_DIR across rebuilds

The original choice for completely destroying $OUT_DIR was to focus on
repeatable builds to ensure that stale items in $OUT_DIR don't affect later
compilations. This commit moves this responsibility from cargo to the build
command itself.

Build commands are now responsible for cleaning out old artifacts and ensuring
that when invoked the state of $OUT_DIR is as it would be if it started with an
empty $OUT_DIR. This will allow for very long build commands based on `make` to
have a much faster incremental build time as they won't have to rebuild
everything when updated.

This can cause non-repeatable builds with build commands if stale artifacts are
never removed (but still used in the rust compilation step), but this will now
be considered a bug in the build command rather than for cargo itself.

Closes #382
Allow updating transitive deps

Previously `cargo update foo` would only update the package `foo` if it were a
direct dependency of the local package. This meant that to update a transitive
dependency you would have to update the top-level dependency.

This commit adds the ability to update any dependency by name, regardless of
where it is in the dependency graph. This commit is a bit lossy in terms of
behavior. We are guaranteed that the set of immediate dependencies for any one
package have unique names, but not for the entire package graph. This means that
when you invoke `cargo update foo` it could possibly update two packages named
`foo`.

I believe this behavior to be acceptable for now and we can add a more stringent
update syntax later (something like `cargo update --namespace foo bar`). I
believe we'll always want this CLI usage, however.
Make a timing test a little less flaky