feat: add Cargo.toml manifest checker for Rust dependencies

[algomaster99]

Adds support for checking Rust Cargo.toml manifests, enabling the hook to detect and block writes that pin crates to outdated versions.

Summary

Implements a new cargo package that checks Cargo.toml files for exactly-pinned (=) dependencies that are older than the latest released version. This brings Rust/Cargo support to yul alongside the existing npm, PyPI, Maven, Go, and GitHub Actions checkers.

Key Changes

• New pkg/cargo package with manifest parsing and version checking:

  • parseCargoPins() extracts exactly-pinned dependencies from Cargo.toml using git-pkgs/manifests, handling string-form (serde = "=1.0.0"), table-form ({ version = "=1.0.0" } ), and special cases (local paths, workspace dependencies)
  • CheckCargoToml() diffs before/after manifests and reports mismatches only for changed dependencies, reusing the shared pins.Diff logic
  • Correctly treats bare versions (e.g., "1.2.3") as caret ranges (^1.2.3), not exact pins, per Cargo's default semantics — only = prefix counts as exact
  • Scopes pins by section (runtime/, development/, build/) since the parser doesn't expose per-declaration locations

• Integration into main hook:

  • Wired cargo.Checker into newCheckers() in main.go
  • Updated README.md to document Cargo.toml support

• Comprehensive test coverage (pkg/cargo/cargo_test.go):

  • Parsing of various dependency formats and sections
  • Exact pin detection (bare versions ignored, = prefix required)
  • Changed-dependency-only checking (untouched crates never queried)
  • Same-crate-different-section independence
  • Fake resolver to avoid network calls

• Benchmark cases added for empirical evaluation:

  • Five fresh/existing Cargo.toml scenarios covering reqwest, serde, tracing, uuid, and tokio

Implementation Notes

• Follows the same pattern as pkg/golang and pkg/pyproject for ecosystems where the manifest parser doesn't expose stable per-declaration locations
• Fails open (never blocks) if the resolver lacks pkg:cargo data, matching existing behavior for other ecosystems
• Uses requireOperator=true in pins.ExactVersion() to enforce the = prefix, documenting the Cargo-specific gotcha explicitly

https://claude.ai/code/session_014uMpiDuvuN7HV9fgPZaQu2