Fix Cargo.lock Git source dependency matching

[Cameron Taggart (cataggar)]

Summary

• Resolve Cargo.lock Git dependency references against package sources that append #<commit>, while preserving exact matching for other sources and Git repository/ref.
• Restore dependency edges for valid lockfiles containing both registry and Git copies of a crate.
• Bump the RustSbom detector version to 3 because the dependency graph changes.
• Skip the detector-version reminder on fork pushes, where the PR lives upstream and cannot be found in the fork.
• Add unit tests for a Cargo-generated public itoa lockfile, a Git-to-Git dependency edge, a mismatched Git ref, and the detector version.

Fixes #1880

Tests

• dotnet test test/Microsoft.ComponentDetection.Detectors.Tests/Microsoft.ComponentDetection.Detectors.Tests.csproj --no-restore -p:ExcludeIntegrationTests=false -- --filter "FullyQualifiedName~RustCargoLockParserTests|FullyQualifiedName~RustSbomDetectorTests" (51 passed)

[Greg Villicana (grvillic)]

/azp run

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂