Reduce the number of Zebra dependencies, and remove duplicate dependencies

[teor2345]

Motivation

In Zebra, we have a lot of:

• different crate dependencies, and
• duplicate versions of the same crate dependency.

But each dependency is a security risk, because dependency code runs in the Zebra process, and some of that code could be unsafe. (Or impact performance or privacy.) Each dependency also makes compilation and runtime performance slower.

So we need to carefully review Zebra's dependencies, particularly before we are audited.

Scheduling

This risk is acceptable for the first stable release, but we should review it when we handle user-generated transactions with lightwalletd.

Tasks

Remove unused dependencies:
- [ ] Identify unused dependencies and remove them
- [ ] Run cargo udeps in CI

• Remove duplicate dependencies
  • TODO: add easy duplicate dependency tickets here

Related Work

• Document how we review dependency changes #3183

[teor2345]

I ran cargo udeps recently, and there were no unused dependencies.

[mpguerra]

Hey team! Please add your planning poker estimate with ZenHub @conradoplg @dconnolly @jvff @oxarbitrage @teor2345 @upbqdn

[teor2345]

This is an ongoing task that we will do as dependencies upgrade.