Investigate if custom registries should result in purl's with a different type from "cargo"

From #226's

> 3. Is the purl standardized for Rust somewhere in the spec? What should the purl be for crates not distributed via crates.io?

The [purl specification](https://github.com/package-url/purl-spec#purl) does not indicate a required type specific to Rust, beyond

> type: the package "type" or package "protocol" such as maven, npm, nuget, gem, pypi, etc. Required.

Investigate what other CycloneDX tools are doing, particularly if they support private repositories. Rust supports [private registries](https://doc.rust-lang.org/cargo/reference/registries.html) and indicates at a per-dependency level what registry it comes from, so we should be able to access this information if we want to use that as the purl's `type` for a dependency component and the `[package]`'s `publish` list for the package's component

Review how Cargo exposes per-dependency registries and the [package] publish list, then compare how other CycloneDX tools represent private repositories in purls. Done means documenting whether custom registries require a different purl type and identifying the expected behavior for dependency and package components.

Written by the indexing model from the issue text.