Right now cargo audit provides flexible controls for which kinds of advisories are reported (e.g. show/hide unmaintained or unsound) and which are considered fatal (i.e. cause non-zero exit code, cause CI to fail) via a config file is to be located in .cargo/audit.toml. But this is not discoverable, leading to people complaining that the default doesn't work well for them and asking to change the defaults.

We need to better document the existence of this configuration file.