[Pre-RFC] `cargo package` should include fewer files by default

Only during verification, for that (and IIRC other reasons, though it's been a while), I commonly have to publish with --no-verify and just pray.