Update imports.lock less frequently

[mystor]

This patch reduces the frequency that imports.lock updates by doing a
few things:

• Imports are only updated when necessary for the vet to pass. If vet
  would successfully pass without the new audits, only changes to
  notes, criteria descriptions, revoked audits, and violations will be
  pulled.

• Some commands, such as suggest, will always run against the live
  copy when not --locked, providing the most accurate results possible.

• Only audits for crates in your crate graph will be imported.

• When an update is required, all new audits for the given crate will
  be fetched and locked, to batch updates as much as possible.

This required doing some changes to how imports are handled under the
hood, as well as a number of changes to the resolver in order to track
whether fresh imports are required with sufficient accuracy. Imports are
also now fetched in more APIs in order to have the most up-to-date
information.

The changes to the resolver involved piping through "caveats" which are
determined when solving paths. This is an expansion on the existing
"needs_exemption"/"fully_audited" flags which were being used to
generate stats after a successful vet to also handle freshly imported
audits which should only be used when necessary.

Special handling was also needed to make sure that audits for unused
criteria are not counted by tracking caveats on a per-criteria basis and
bubbling them out.

Fixes #272

[bholley]

Gankra gave this the thumbs-up.