Limit --exclude to workspace packages

Previously, --exclude would start from the set of all packages
referenced in a workspace, i.e., the workspace's packages plus any
dependencies. Without --exclude, we would at most look at all the
workspace's packages, so --exclude would result in possibly verifying a
larger set of packages.

kani-driver/src/call_cargo.rs

@@ -320,7 +320,11 @@ fn packages_to_verify<'b>(
             .collect()
     } else if !args.cargo.exclude.is_empty() {
         validate_package_names(&args.cargo.exclude, &metadata.packages)?;
-        metadata.packages.iter().filter(|pkg| !args.cargo.exclude.contains(&pkg.name)).collect()
+        metadata
+            .workspace_packages()
+            .into_iter()
+            .filter(|pkg| !args.cargo.exclude.contains(&pkg.name))
+            .collect()
     } else {
         match (args.cargo.workspace, metadata.root_package()) {
             (true, _) | (_, None) => metadata.workspace_packages(),