Consider moving web-sys dependency from wgpu-core to wgpu

[jimblandy]

Firefox uses wgpu-core, but not wgpu. #2603 added web-sys as a dependency of wgpu-core. Firefox requires that all dependencies be vetted for security, so we would very much like to avoid taking on new dependencies unless absolutely necessary.

I haven't looked at how web-sys is being used at all, and don't have any background. I'm just filing this as a reminder to look into whether it can be conveniently hoisted up a level at some point.

[jimblandy]

You might wonder why cargo vet (the tool Firefox is using to track these audits) doesn't just ignore wasm32 dependencies, since we don't ship Firefox as a web page. It turns out that Firefox already compiles some of its C++ components to Wasm just for the sandboxing properties. It wouldn't be surprising if it did the same with Rust at some point in the future. So we can't use "Firefox never runs wasm32 targets" as a simplifying assumption.

[cwfitzgerald]

I think it could be possible to add a webgl feature to wgc so firefox doesn't see the web-sys dep.

[cwfitzgerald]

Such a dependency doesn't seem to exist anymore.