[Pre-RFC] `cargo package` should include fewer files by default

It's good to hear about other Rustaceans that go through the struggles of suppy chain reviews as well. As mentioned, the license issue you are describing is definitely a pain point, but I fear it is out-of-scope for this particular Pre RFC. Regarding tests, I am not sure if reducing the amount of files that should be included by default will automatically lead to fewer working tests. Automatically checking the tests as part of the packaging/publishing process has been discussed in this thread as well, but I fear it might be out-of-scope as well. I also would reckon that crate authors that are aware of the usefulness of tests in their crate will make sure to include the correct set of files. Having more complex test setups should go hand in hand with a heightened awareness of why including additional test data in the shipped crate is important (or is not important). And here, requiring the authors to explicitly include these files should make sense in my opinion.