Bad feature selection with default-features=false in dependencies from workspace.dependencies

I have a reproduction here : https://github.com/rbtcollins/rules_rust_features_reproduction

The essence of the symptom is this: A cargo workspace that builds fine in cargo, fails to build with very vanilla crates_universe settings.

This breaks:
```

[dependencies]
sqlx.workspace = true

[workspace.dependencies]
sqlx = { version = "0.7.1", default-features = false, features = [
"runtime-tokio-rustls",
"migrate",
] }

```

This works:
```

[dependencies]
sqlx.workspace = true

[workspace.dependencies]
sqlx = { version = "0.7.1", features = [
"runtime-tokio-rustls",
"migrate",
] }

```

And the difference, looking at the bazel cargo lock file (in the reproduction repo, the first commit works, the second breaks), seems to be that the disabled default features are applied transitively, leading to e.g. serde_json being built without neither alloc nor std support enabled.