Relax zeroize dependency

[rozbb]

This PR:

• Relaxes zeroize to ^1
• Improves documentation about this crate's MSRV
• Fixes the MSRV tests. Previously they were using the newest deps. But the MSRV should be calculated with respect to the oldest possible deps.

I would like to cut a release soon. According to the MSRV test, our v4.0 will not require an MSRV bump.

[rozbb]

Would it be better actually to do cargo hack +MSRV build --powerset? This is what the RustCrypto minimum-versions script does, which is pulled in in zeroize.

[tarcieri]

I would still suggest bumping MSRV. Though the minimum versions will work, the default cargo resolution will not and will throw compile errors if the zeroize feature is enabled.

At least 1.56 introduces rust-version so it can surface a useful message about future MSRV incompatibilities.