False positive of local crate in a project's workspace

[martingallagher]

Describe the bug
False positive of local crate in a project's workspace, this appears to first appear in 0.12.2

To Reproduce
Steps to reproduce the behavior:

1. Clone https://github.com/martingallagher/cargodenybug
2. Run cargo deny --workspace --all-features check
3. Notice advisory regarding RUSTSEC-2020-0076

Expected behavior
In this instance the "routing" member of the workspace is vanilla Rust, it has no connection with any external crate so shouldn't raise a warning.

Device:

• Version 0.12.2

[sbromling]

I have also seen this. It looks similar to #441, where a yanked-crate error was reported for a workspace-local crate of the same name.

In our case, we have a workspace-local crate called "generator", which has the same name as a public crate that has two active security advisories: https://rustsec.org/packages/generator.html.