Rust Cargo.lock file entries which are not real

I havent had a real problem with this, so maybe this is a non-issue, already handled somehow within osv-scanner.

That said, this feels like it is a problem with using `osv-scanner --lockfile Cargo.lock`

I've created https://github.com/jayvdb/apalis-dep-problem showing that the lock file contains "apalis-sql" even though this crate hasnt been included in the build (see compile.log).

This occurs because the demo project asks for the "tokio-comp" feature, which is defined as including `apalis-sql?/async-std-comp`, which makes it optional, and means apalis-sql is only included if it is included for some other reason.
https://github.com/geofmureithi/apalis/blob/v0.4.6/Cargo.toml#L60-L65

Likewise "apalis-redis" and "apalis-cron" appear in the lock file, but not in the compile log.

I found it quite strange that these are appearing in the lock file.

If there is a CVE in any of those crates, I expect osv-scanner would report it, even if it hasnt been included in the project.

Possibly there is an issue in cargo to improve the situation by not including these in the lock file. I havent looked yet.

Also semi-related, and this time confirmed, osv-scanner reports CVEs that appear only in dev-dependencies. https://github.com/google/osv-scanner/issues/332 is related to that.

Finally, Cargo.lock files often contain crates for platforms that the user has no intention of building for, and any CVEs in those are likely to be reported by osv-scanner without any want to distinguish that they are irrelevant. e.g. the following lock entry which has deps for lots of platforms.
```toml
[[package]]
name = "iana-time-zone"
version = "0.1.58"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8326b86b6cff230b97d0d312a6c40a60726df3332e721f72a1b035f451663b20"
dependencies = [
"android_system_properties",
"core-foundation-sys",
"iana-time-zone-haiku",
"js-sys",
"wasm-bindgen",
"windows-core",
]
```

The trouble with reporting vulns against crates which are not used in the build is that then they are put into the `IgnoredVulns` with the rationale that it is only a dev-dependencies/false positive/etc, and it would allow the vuln to creep in via real dependencies also without being noticed.

IMO osv-scanner should emit a warning when called with `--lockfile` & a Cargo.lock detected, but possibly other types of lock files also, informing that the Cargo.lock file includes crates not present in builds, and recommend using `--sbom` or other approaches instead.