Exclude development scripts from published package

[weiznich]

During a dependency review we noticed that the bytes crate includes various development scripts. These development scripts shouldn't be there as they might, at some point become problematic. As of now they prevent any downstream user from enabling the [bans.build.interpreted] option of cargo deny.

I opted for using an explicit include list instead of an exclude list to prevent these files from being included in the published packages to make sure that everything that's included is an conscious choice.

[martin-g]

I wonder whether tests/**/*.rs and benches/**/*.rs should be added too.
They are not needed for the build as a (transitive) dependency of a project but still they are part of the source distribution.

[weiznich]

There are arguments for excluding and including these directories:

For excluding: Almost 100% of the users that consume the code from crates.io don't run or use these tests or benchmarks at all.

For including: There are specific usage patterns which might benefit from having these folders there:

• Linux distributions running tests as part of their package builds
• Possibly crater, but crater also fetches github repositories so that might not be that important

I personally tend to exclude these folders whenever possible as the large majority of users won't need them. For the exceptions there are other solutions. That's also a something shared by other large projects like reqwest or rustls.

[Darksonn]

I'd like to include the tests but not benchmarks.

[weiznich]

I pushed an update to do that

[Darksonn]

Including the clippy config file also seems harmless, and might help for anyone who vendor their dependencies using versions from crates.io.

[Darksonn]

Thanks.