Limit `registry-index` dependency field to registry sources only

[epage]

When publishing a package with a custom registry, Cargo resolves the dependency registry field to registry-index (#14500). However, registry-index is for internal purposes only and this is not intended as a means for people to bypass the need for .cargo/config.toml (see #12738 for that use case).

We should look into a way to close this hole to avoid people relying on it unintentionally.

[epage]

We could have the manifest parser error if the Source is not a Registry.

That might cause problems with the verify step though.