Add source tarballs to our releases (#4294)

* Add source tarballs to our releases

This commit adds a small script to create a source tarball as part of
the release process. This goes further than requested by #3808 by
vendoring all Rust dependencies as well to be more in line with
"download the source once then build somewhere without a network".
Vendoring the Rust dependencies makes the tarball pretty beefy (67M
compressed, 500M uncompressed). Unfortunately most of this size comes
from vendored crates such as v8, pqcrypto-kyber, winapi, capstone-sys,
plotters, and web-sys. Only `winapi` in this list is actually needed for
`wasmtime`-the-binary and only on Windows as well but for now this is
the state of things related to `cargo vendor`. If this becomes an issue
we could specifically remove the bulky contents of crates in the
`vendor` directory such as `v8` since it's only used for fuzzing.

Closes #3808

* Review feedback

* Review comments

.github/workflows/main.yml

@@ -407,6 +407,10 @@ jobs:
     - uses: actions/checkout@v2
       with:
         submodules: true
+    # On one builder produce the source tarball since there's no need to produce
+    # it everywhere
+    - run: ./ci/build-src-tarball.sh
+      if: matrix.build == 'x86_64-linux'
     - uses: ./.github/actions/install-rust
     - uses: ./.github/actions/binary-compatible-builds
       with: