Previously only */Cargo.lock was matched (one level deep).
Projects like HuggingFace safetensors/tokenizers have
Cargo.lock at bindings/python/Cargo.lock (two levels deep).
Use find to search recursively, and compute the relative
path back to vendor directory dynamically.