Handle local auto-installation of cargo-auditable

[duckinator]

The cargo-auditable option is added in #1516. That PR ensures dist uses cargo-auditable and that cargo-auditable is installed in the generated workflows.

However, this leads the situation of running dist build locally.

I think there's agreement that this should be at least offered, but we need to figure out the details of how/when to do it.