ci: update cargo dependencies with dependabot

[iamralch]

Adds a weekly Dependabot update for Cargo dependencies (Cargo.toml and Cargo.lock).

• Minor and patch updates are grouped into one PR; major updates get their own PR.
• Unlike the GitHub Actions updates, these are not labeled auto-merge: no checks are required on main, so auto-merge would merge a crate update before CI runs.