chore: enforce unreachable_pub lint

The `unreachable_pub` lint makes us aware of uses of `pub` that are not actually reachable from the crate root. This is considered good because it means reading a `pub` somewhere means it is actually public API. Some of our crates are quite large and keeping their entire API surface in your head is difficult.

We should strive for most items being `pub(crate)`. This lint helps us enforce that.

Pull-Request: #3735.

identity/src/lib.rs

@@ -42,8 +42,9 @@
     feature = "rsa"
 ))]
 mod proto {
+    #![allow(unreachable_pub)]
     include!("generated/mod.rs");
-    pub use self::keys_proto::*;
+    pub(crate) use self::keys_proto::*;
 }
 
 #[cfg(feature = "ecdsa")]

identity/src/rsa.rs

@@ -159,12 +159,12 @@ struct Asn1RawOid<'a> {
 
 impl<'a> Asn1RawOid<'a> {
     /// The underlying OID as byte literal.
-    pub fn oid(&self) -> &[u8] {
+    pub(crate) fn oid(&self) -> &[u8] {
         self.object.value()
     }
 
     /// Writes an OID raw `value` as DER-object to `sink`.
-    pub fn write<S: Sink>(value: &[u8], sink: &mut S) -> Result<(), Asn1DerError> {
+    pub(crate) fn write<S: Sink>(value: &[u8], sink: &mut S) -> Result<(), Asn1DerError> {
         DerObject::write(Self::TAG, value.len(), &mut value.iter(), sink)
     }
 }