Bug#1049413: librsvg: Update to 2.56 or later

[Simon McVittie]

On Tue, 15 Aug 2023 at 18:41:49 +0200, Matthias Geiger wrote:
> the latest rsvg would need ~ 10 NEW rust packages if it were to be
> devendored. iirc you can actually run "cargo vendor" and it would revendor
> the tarball (even with out upstream vendoring it).

Given the policy that Jeremy linked to, I imagine Ubuntu will want to
produce a fully-vendored tarball, even if Debian does not.

Producing a fully-vendored tarball of 2.55 or higher would be the closest
thing to the status quo, so I think that would be a valid way to update
librsvg, even if the Debian Rust team would prefer us to do it differently.

Is it possible to vendor *some* dependencies, and take others from
Debian? That seems a lot more feasible to me than de-vendoring literally
everything, and in particular would avoid librsvg getting stuck behind
a new Rust library getting through NEW.

    smcv