Tidy: Check Cargo.lock for packages with same version and different sources
<!-- Please describe your changes on the following line: -->
r? @Wafflespeanut
cc @SimonSapin
---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `__` with appropriate data: -->
- [X] `./mach build -d` does not report any errors
- [X] `./mach test-tidy` does not report any errors
- [X] These changes fix#14695
<!-- Either: -->
- [X] There are tests for these changes
<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->
<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/14715)
<!-- Reviewable:end -->
Allow tidy to run custom project-specific lints
<!-- Please describe your changes on the following line: -->
Since tidy is a package, it shouldn't contain our WPT lint. This PR changes the file list generator (we already have) into an object, and allows tidy to run custom python lint scripts (specified in the config file) under the context of `LintRunner`. The errors are then chained into our mechanism.
r? @frewsxcv (cc @jdm @edunham @aneeshusa and anyone else interested in reviewing it)
---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `__` with appropriate data: -->
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
<!-- Either: -->
- [x] There are tests for these changes
<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->
<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/14166)
<!-- Reviewable:end -->
It is called nsstring_vendor since libgkrust already depends on nsstring, and
we can't have two crates with the same name in-tree. We can't directly depend
on the in-tree one since this will stop independent `./mach build-geckolib` builds from working.
MozReview-Commit-ID: CR4tHgzXWFZ
