Fix crates.io URL (#2597)

- Resolves #2586
- All other statements already use the correct CDN urls / git repos,
based off of the `config.json`
- The hardcoded path seems to be based off a last ditch effort if theres
not metadata spliced from the crate. I think using the hardcoded path is
fine here, due to the fact that its last ditch, and I do not think the
crates download url will be changing often.

crate_universe/src/metadata/metadata_annotation.rs

@@ -272,10 +272,11 @@ impl LockfileAnnotation {
         // metadata the raw source info is used for registry crates and `crates.io` is
         // assumed to be the source.
         if source.is_registry() {
+            // source url
             return Ok(SourceAnnotation::Http {
                 url: format!(
-                    "https://crates.io/api/v1/crates/{}/{}/download",
-                    lock_pkg.name, lock_pkg.version,
+                    "https://static.crates.io/crates/{}/{}/download",
+                    lock_pkg.name, lock_pkg.version
                 ),
                 sha256: lock_pkg
                     .checksum