Dependabot only makes Rust security updates if "Cargo.lock" exists

I'm seeing behavior where the "Cargo.toml" file isn't updated when the "Only security updates" option is checked. Dependabot only updates it if a "Cargo.lock" file exists.

For example, if this is the dependency list in "Cargo.toml":
```toml
[dependencies]
openssl = "0.8"
```

Dependabot doesn't send a pull request. However, after running `cargo update` and pushing the lock file, it creates a pull request to update "Cargo.toml" and "Cargo.lock".

I decided not to use this option, but I still think this is still important. Libraries usually [don't commit their "Cargo.lock" file](https://doc.rust-lang.org/cargo/faq.html#why-do-binaries-have-cargolock-in-version-control-but-not-libraries), so their dependencies wouldn't be updated. This was tested in a private repository.