build: do not use workspace dependencies

[Benoît Cortier (CBenoit)]

As written in the workspace Cargo.toml:

Note that for better cross-tooling interactions, do not use workspace
dependencies for anything that is not "workspace internal" (e.g.: mostly
dev-dependencies). E.g.: release-plz can’t detect that a dependency has been
updated in a way warranting a version bump in the dependant if no commit is
touching a file associated to the crate. It is technically okay to use that
for "private" (i.e.: not used in the public API) dependencies too, but we
still want to make follow-up releases to stay up to date with the community,
even for private dependencies.

Expectation is that release-plz will be able to auto-detect when bumping dependents is necessary.

Closes #689