cargo install --frozen with a vendor directory set in .cargo/config is updating the crates-io index while it shouldn't do that.

This can currently be solved with --offline, but it should not attempt reach out to the internet with --frozen.

Also, --offline doesn't exist before v1.36.0.

Reproducing this:

• Cargo.toml

[package]
name = "cargo-install-vendor"
version = "0.1.0"

[build-dependencies]
cbindgen = "0.9.1"

• .cargo/config

[source.crates-io]
replace-with = "vendored-sources"

[source.vendored-sources]
directory = "[redacted pwd]/vendor"

$ cargo vendor
[...]
$ cargo install --frozen cbindgen
error: attempting to make an HTTP request, but --frozen was specified