Separating fetching from building for better security

grothesque:

For example, truly replicating the fetches that some cargo build invocation would perform without running cargo build seems very difficult currently.

Hmmm, this seems odd to me, I've been using a similar wrapper script for years doing a simple cargo fetch and not run into such issues.