Hide unsound and unmaintained crates from search (except for verbatim matches); display security information front and center

[LeoniePhiline]

It is non-obvious to users if a crate's repository is archived and the crate unmaintained.

For example, https://crates.io/search?q=serde%20yaml yields https://crates.io/crates/serde_yml, which was (luckily) discontinued.

There is at least an (easy to overlook) "security" tab, which lists the unsound and unmaintained status of this example crate: https://crates.io/crates/serde_yml/security

But the crate page still looks attractive and may lure many new Rustaceans into using this garbage library.

This is library is of course only an example – there are going to be many such cases.

Proposals

1. Hide crates from search which are archived/unmaintained. Surface them only upon verbatim matches or via a somewhat hidden search filter setting, to prevent people from shooting themselves in the foot.

2. Highlight security issues well-visible in the search results lists, annotating each problematic crate with tags in warning colors.

3. Highlight security issues and in the crate page front and center, with no way to miss it. (I.e. not hidden in a "Security" tab, but at the top of the page, as red banner (color depending on severity?), and linking to the tab for more information).