Minor: Document the rationale for the lack of Cargo.lock

[alamb]

Which issue does this PR close?

The question of why Cargo.lock is not checked in comes up from time to time, most recently in

• Bump ctor to 0.2.9 #14069 (review)
  from @mbrobbel

Rationale for this change

I think documenting the rationale as I understand it will help:

1. To answer questions about why it is this way
2. Help us decide if we want to change the process

What changes are included in this PR?

Document my recollection of why Cargo.lock is not checked in

Are these changes tested?

By CI

Are there any user-facing changes?

Update the readme

[alamb]

@mbrobbel has a good point here #14069 (comment)

I think one concern originally was how we would keep a Cargo.lock file up to date with the latest version of the dependencies

I can't remember if depndabot was available at that point -- maybe dependabot is good enough that we could check in Cargo.lock and have Dependabot update it

[alamb]

From my perspective it is very important that CI covers testing with the latest versions of all dependencies (as that is what many/most downstream crates will use as well)

[mbrobbel]

I'd like to point to https://blog.rust-lang.org/2023/08/29/committing-lockfiles.html for considerations and suggestions.

[alamb]

TLDR it sounds like the rust team now suggests always committing Cargo.lock and letting dependabot handle updates. That seems like a good idea to me

[gatesn]

Just my two cents, but I have found Renovate to be much more configurable. Here's an example of a lock file maintenance PR: vortex-data/vortex#1818

[alamb]

One thing we have to be aware of in DataFusion is that as part of the Apache security posture, only certain third party actions are allowed -- we would have to double check Rennovate

I think the next step is probably to file an issue to explicitly discuss checking in a Cargo.lock file. I'll try and find time over the next few days if no one beats me to it

[alamb]

I filed a ticket to discuss next steps:

• Discuss: Check in Cargo.lock file? #14135

[comphead]

lgtm thanks @alamb for getting this documented