deps: consider conquer-once or lock_api instead of spin

[trivikr]

I ran cargo audit on deno by following instructions in blog post

Output:

    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 69 security advisories (from /home/trivikr/.cargo/advisory-db)
    Scanning Cargo.lock for vulnerabilities (203 crate dependencies)
     Success No vulnerable packages found

warning: 1 warning found

Crate:  spin
Title:  spin is no longer actively maintained
Date:   2019-11-21
URL:    https://rustsec.org/advisories/RUSTSEC-2019-0031
Dependency tree: 
spin 0.5.2
└── ring 0.16.9
    ├── webpki 0.21.0
    │   ├── webpki-roots 0.17.0
    │   │   ├── reqwest 0.10.1
    │   │   │   └── deno 0.30.1
    │   │   │       └── test_plugin 0.0.1
    │   │   └── deno 0.30.1
    │   ├── tokio-rustls 0.12.2
    │   │   ├── reqwest 0.10.1
    │   │   ├── hyper-rustls 0.19.0
    │   │   │   └── reqwest 0.10.1
    │   │   └── deno 0.30.1
    │   ├── rustls 0.16.0
    │   │   ├── tokio-rustls 0.12.2
    │   │   ├── rustls-native-certs 0.1.0
    │   │   │   └── hyper-rustls 0.19.0
    │   │   ├── reqwest 0.10.1
    │   │   └── hyper-rustls 0.19.0
    │   ├── hyper-rustls 0.19.0
    │   └── deno 0.30.1
    ├── sct 0.6.0
    │   ├── rustls 0.16.0
    │   └── ct-logs 0.6.0
    │       └── hyper-rustls 0.19.0
    ├── rustls 0.16.0
    └── deno 0.30.1

warning: 1 warning found!

[trivikr]

Closing as spin is not a direct dependency
Refs: briansmith/ring#921