publish: Normalize dependency version requirements

[Turbo87]

When cargo reads a Cargo.toml file and sees a foo = "1.0" dependency declaration it saves the version requirement as a semver::VersionReq. If cargo then publishes the crate and transforms the dependency declaration to the publish metadata JSON blob it essentially uses semver::VersionReq::to_string() which normalizes the version requirement and transforms 1.0 into ^1.0.

On the crates.io side we've been accepting these values from the metadata as-is and only using VersionReq::parse() to check if it is a valid version requirement, but there was no normalization performed.

Since we now read dependency declarations directly from the embedded Cargo.toml file ourselves (see #7238) the normalization that cargo (unintentionally?) performed is now missing.

This PR brings back the normalization with a VersionReq::parse() and to_string() cycle.