Bundled Steamworks library via Cargo feature

[tbillington]

The bundling of the Steamworks dynamic libraries with releases is very convenient, however it should be possible to opt-out if the user so chooses.

My suggestion would be a bundled feature that is on by default, but could be disabled through the use of "no default features" in Cargo.toml.

Reasons users may opt-out

Supply chain best practice

Users should be able to provide the libraries themselves for full certainty they're legitimate, without needing to compare hashes manually.

Patch updates without relying on steamworks

Users can update the Steamworks dynamic libs if they're semver compliant on their own without requiring an upstream patch by steamworks.

It was mentioned (HouraiTeahouse/bevy_steamworks#34 (comment)) that this may cause issues with bindgen on breaking changes, but I don't understand this aspect myself.

---

Prior art in bundling binary libraries: Rusqlite (Sqlite).

---

Another option, though I don't know how preferable this is, is either a build.rs step or shell script in the repo that would fetch from the official steamworks servers eg (https://partner.steamgames.com/downloads/steamworks_sdk_159.zip) and unpack the libraries locally.

That could be a separate feature ("download_sdk"?) that users could use in addition to disabling "bundled" to automate the process of acquiring the steamworks sdk.