Don't warn about `metadata` keys in the manifest

Don't warn about `metadata` keys in the manifest

External tools may want to store metadata in `Cargo.toml` that they read but
Cargo itself doesn't read. For example `cargo-apk` uses this for pieces of
configuration. Cargo unfortunately, however, warns about these keys as "unused
keys in the manifest"

This commit instead whitelists the `package.metadata` key to not warn about any
data inside.