Scanning: Rust (crates.io) support via Cargo.lock

[rupertgermann]

Parent

#6

What to build

Add Rust coverage to repository scanning: Cargo.lock files are parsed into crates.io-ecosystem dependencies (package name + exact version from lock entries) and checked against OSV. Discovery reuses the existing subdirectory tree-walk. The supported-ecosystems registry gains the new file type so the repos UI reflects it automatically.

Acceptance criteria

• A Cargo.lock fixture yields the expected crate@version tuples in the crates.io ecosystem
• Workspace-member and path/git dependencies without registry versions are skipped without breaking the scan
• Cargo.lock files in subdirectories are discovered in monorepos
• The supported-ecosystems list in the repos UI includes Cargo.lock
• A scan of a repo with a known-vulnerable crate surfaces OSV findings end-to-end
• TDD: parser behavior covered at the dependency-parser seam with fixture files; scan path covered with globalThis.fetch swapped; npm test green

Blocked by

None - can start immediately