Patch bundled libcurl when upstream CVEs come out

[DemiMarie]

Many of them may not effect us (TFTP, FTP, etc), but we should still patch them.

[sagebind]

Any particular examples you are referring to?

This is probably an issue for the curl-sys crate to handle, as long as we keep up to date with the latest curl-sys versions. To my knowledge, curl-sys keeps relatively up-to-date with upstream source.

[DemiMarie]

None in particular; cURL’s HTTP implementation has a fantastic security record.

[sagebind]

The curl and curl-sys crate have a pretty good record of staying up-to-date with upstream libcurl patches. Feel free to let me know if there's more work to be done.