It looks like firefox bundles cbindgen + its dependencies just to build the "cbindgen" binary, which is then only used during the build process but not shipped.

This should not be necessary: cbindgen has been packaged for Fedora for a while, and the latest version is available from the repositories (the "cbindgen" package provides "/usr/bin/cbindgen"):
https://src.fedoraproject.org/rpms/rust-cbindgen/

Dropping the vendor tarball for cbindgen + its dependencies and using /usr/bin/cbindgen from the cbindgen package directly should also slightly reduce build times for firefox (on the order of ~15 minutes).