feat(ecosystem): Add Cargo (Rust) package scanning

[amotmot]

Adds Cargo / Rust support to bumblebee with no additional go modules deps.

Files added

• internal/ecosystem/cargo/cargo.go — new Cargo scanner
• internal/ecosystem/cargo/cargo_test.go — unit tests for .crates2.json and Cargo.lock parsing

Files changed

• internal/model/model.go — add EcosystemCargo (crates.io) to supported ecosystems
• internal/osv/osv.go & internal/osv/osv_test.go — map crates.io to OSV ecosystem for vulnerability lookups
• internal/scanner/scanner.go — wire Cargo dispatch into the file walker
• README.md & docs/inventory-sources.md — document Cargo sources and profile coverage