[product-manager-impersonator] Add Rust/Cargo guidance to dependency-review

## Feature Idea

**Summary:** Extend the dependency-review workflow with explicit Rust/Cargo classification and ecosystem-specific checks so Cargo PRs get the same quality of analysis as Go/npm/Python/Java updates.

## Why a Customer Would Want This
Teams using Dependabot/Renovate for Rust dependencies want review comments that call out Cargo-specific risk signals (like yanked versions and major crate compatibility changes) instead of generic analysis. That improves trust in automated dependency triage and reduces manual follow-up on every Rust bump.

## Rough Implementation Sketch
- Add Cargo detection rules in `.github/workflows/gh-aw-dependency-review.md` alongside existing manifest-to-ecosystem mappings (e.g., `Cargo.toml`, `Cargo.lock`).
- Add a Rust/Cargo ecosystem guidance section beside the current Go/npm/Python/Java sections in the same prompt file.
- Update `gh-agent-workflows/dependency-review/README.md` to explicitly list Rust/Cargo in supported ecosystems and expected checks.
- Add one short docs/example snippet showing how Cargo updates are analyzed in output comments.

## Why It Won't Be That Hard
This is a focused enhancement to one existing workflow family (prompt + docs) with no new runtime service, no new safe-output type, and established patterns already present for other ecosystems in the same file.

## Evidence
- `.github/workflows/gh-aw-dependency-review.md` classifies ecosystems and manifests, but currently enumerates GitHub Actions, Buildkite, Go, npm, Python, and Java/Kotlin (`~120-132`).
- `.github/workflows/gh-aw-dependency-review.md` includes ecosystem-specific guidance blocks for Go/npm/Python/Java, with no Rust/Cargo peer block (`~208+`).
- `gh-agent-workflows/dependency-review/README.md` describes ecosystem-specific handling but does not explicitly call out Rust/Cargo in its concrete list (`~7`).
- `gh-agent-workflows/dependency-review/example.yml` already routes bot-driven dependency update PRs into this workflow (`~3-4`, `~16-19`), so Cargo-specific logic fits the existing execution model.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/31379166847)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Read .github/workflows/gh-aw-dependency-review.md, especially the manifest mappings around lines 120-132 and ecosystem guidance after line 208, then compare the existing Go, npm, Python, and Java sections. Check gh-agent-workflows/dependency-review/README.md and example.yml for the documented flow. Done means Cargo.toml and Cargo.lock are classified, Rust/Cargo checks are described, and the README includes a representative output example.

Written by the indexing model from the issue text.