CI failure: thread_local nested dep

[vdice]

Noticed a failure in CI for a docs PR recently (https://github.com/deislabs/bindle/runs/4929658603?check_suite_focus=true). Appears to stem from a security vulnerability in the thread_local crate, a nested dep of this project. The direct dep that uses this is tracing_subscriber. It looks like a commit has already been merged revving thread_local: tokio-rs/tracing#1858. Hence, it may be wise to wait for the next release of tracing_subscriber to bump in this project's Cargo.toml... otherwise, I suppose we could explicitly set a version for the nested dep?

[thomastaylor312]

Generally we can't pin the version of a nested dep without using things that makes us unable to publish the crate. So we'll need to wait until the new version is released from tracing subscriber I think