auto merge of #725 : alexcrichton/cargo/registry-fixes, r=brson

This PR contains a laundry list of improvements when using the registry as a source, and should be one of the last steps necessary for whipping cargo into shape to using the registry. Some of the highlights include:

* All APIs have been updated to the registry's current interface
* Lockfiles are now respected with registry sources
  * Conservatively updating dependencies should work
  * The network shouldn't be touched unless absolutely necessary
  * Lockfiles actually keep versions locked when using a newer registry with more versions
* A new standalone lib was added for interoperating with the registry (HTTP-request-wise)
* Packages are now verified before being published to the registry (this can be opted out of)
* `cargo upload` was renamed to `cargo publish`

The commit series is intended to be individually reviewable and each commit should compile and pass all tests independently (but still needs to be applied in order).