Define workflow for verifying MSRV for [lib]s where version reqs support a range of MSRV

[epage]

[lib]-only crates generally do not maintain a Cargo.lock file which makes verifying MSRV difficult because a dependency version requirement might cover a range of MSRVs.

Case studies

• Clap's MSRV checks broke (and many dependent crate's CIs broken) when bitflags updated its MSRV
  • clap 2.33.3 has incorrect MSRV due to bitflags 1.3 MSRV bump clap-rs/clap#2691
  • fails to compile clap 2.33.3 -- 'if' is not allowed in a 'const fn' clap-rs/clap#2734
  • MSRV broken in minor version clap-rs/clap#2735
• To prevent that scenario, Nom constrained the upper bound of their version req, breaking other people's builds

As far as I'm aware, the only solution I know for this is to keep a Cargo.lock.msrv and to copy it over in CI. cargo-msrv verify natively recognizing this pattern and documenting it would be one solution.

The ideal long term solutions are

• -Z minimal-versions that only does minimal versions for direct dependencies (see ehuss's comment) (only a partial solution)
• Cargo's resolver to take MSRV into account

(somewhat related to #117)

[foresterre]

Excellent suggestion, thanks for opening an issue!
I'll have a proper look at this soon.