Thin local LTO enabled for dependencies regardless of lto setting

[tgnottingham]

Thin local LTO is enabled for dependency crates despite setting lto = "off" (as long as the opt-level is non-zero and codegen-units is greater than 1, as usual). For example, it's enabled for dependencies in both the release and dev profiles with this configuration:

[profile.release]
lto = "off"

[profile.dev]
lto = "off"
opt-level = 1

It seems like lto = "off" should apply to dependencies, the same way opt-level applies to dependencies. The other lto settings (regular fat and thin LTO) should continue to not apply to dependencies, as by design, they only apply to the main crate.

Note that changing this would have some impact on #3244.

To reproduce, place the above profiles in the Cargo.toml of a project that has dependencies, and build with RUSTFLAGS="-Z time-passes" cargo +nightly build -j1. Look for the presence of LLVM_lto_optimize passes in the output when building dependencies.

It may also make sense to support disabling thin local LTO in a package profile:

[profile.release.package.foo]
lto = "off"

But this is currently disallowed, giving the error:

`lto` may not be specified in a `package` profile

cargo 1.49.0 (d00d64df9 2020-12-05)