fix(scanner): Resolve Cargo workspace topology

[reneleonhardt]

What does this PR do?

• Derive local Cargo package and target ownership through a shared bounded offline cargo metadata --no-deps scan.
• Resolve renamed local path dependencies only for eligible normal, build, and dev dependency contexts.
• Keep the manifest-based resolver when Cargo is unavailable or metadata is invalid, ambiguous, or outside the project.

Type of change

• Bug fix
• New feature
• New language support
• Documentation
• Other

Verification

• go test ./scanner -run '^TestCargo' -count=1
• go test ./scanner -count=1
• go test ./...

Additional notes

Depends on the Rust workspace-import foundation merged in #87.

Co-Authored-By: GPT-5.6 Sol codex@openai.com

[JordanCoin]

Reviewed the complete change, including Rust workspace/target resolution, dependency-kind eligibility, bounded Cargo metadata fallback behavior, and test coverage. GitHub CI is green and go test ./... passes locally. No blocking findings.