Issue 6603 - Release tarballs ship a different Cargo.lock

Bug Description:
During release action `Cargo.lock` gets updated, has newer packages than
`Cargo.lock` committed in the repository.
Because of that upstream patches that update `Cargo.lock` do not apply
cleanly to the release tarball.

Fix Description:
Remove `cargo update` from the `download-cargo-dependencies` target. For
updating `Cargo.lock` there is a separate `update-cargo-dependencies`
target that should be used instead.
Additionally, fix `dist-bz2` target to generate tarball with a proper
name when `TAG` variable is not defined.

Fixes: https://github.com/389ds/389-ds-base/issues/6603

Reviewed by: @progier389 (Thanks!)

rpm.mk

@@ -14,7 +14,7 @@ BUNDLE_JEMALLOC = 1
 NODE_MODULES_TEST = src/cockpit/389-console/package-lock.json
 NODE_MODULES_PATH = src/cockpit/389-console/
 CARGO_PATH = src/
-GIT_TAG = ${TAG}
+GIT_TAG = $(if $(TAG),$(TAG),$(PACKAGE)-$(RPM_VERSION)$(VERSION_PREREL))
 # LIBDB tarball was generated from
 #  https://kojipkgs.fedoraproject.org//packages/libdb/5.3.28/59.fc40/src/libdb-5.3.28-59.fc40.src.rpm
 #  then uploaded in https://fedorapeople.org
@@ -45,7 +45,6 @@ update-cargo-dependencies:
 	cargo update --manifest-path=./src/Cargo.toml
 
 download-cargo-dependencies:
-	cargo update --manifest-path=./src/Cargo.toml
 	cargo vendor --manifest-path=./src/Cargo.toml
 	cargo fetch --manifest-path=./src/Cargo.toml
 	tar -czf vendor.tar.gz vendor