Install cargo-vet using a Git commit hash

The hash doubles as a checksum of the code that's downloaded and built. Installing from crates.io doesn't provide equivalent functionality.

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     env:
-      CARGO_VET_VERSION: 0.10.1
+      CARGO_VET_REV: c178261c96c9f820f67817e9c5458db655ddc21f # 0.10.1
 
     steps:
     - uses: actions/checkout@v4
@@ -38,16 +38,19 @@ jobs:
     - uses: actions/cache@v4
       with:
         path: ${{ runner.tool_cache }}/cargo-vet
-        key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }}
+        key: cargo-vet-bin-${{ env.CARGO_VET_REV }}
 
     - name: Add the tool cache directory to the search path
       run: echo "${{ runner.tool_cache }}/cargo-vet/bin" >> $GITHUB_PATH
 
     - name: Ensure that the tool cache is populated with the cargo-vet binary
-      run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --version ${{ env.CARGO_VET_VERSION }} --locked cargo-vet
+      run: cargo install --root ${{ runner.tool_cache }}/cargo-vet --locked --git https://github.com/mozilla/cargo-vet --rev ${{ env.CARGO_VET_REV }} cargo-vet
+      if: steps.cache-cargo-vet.outputs.cache-hit != 'true'
 
     - name: Invoke cargo-vet
-      run: cargo vet --locked
+      run: |
+        cargo vet --version
+        cargo vet --locked
 
   build:
     strategy: