Lint on unused `version` field with git/path dependencies

What it does

Users may add the version field, thinking its relevant for git/path dependencies when it is instead adding a fallback registry source when published. While we can't tell if the user intended it when publish = true, we can when publish = false. Granted, publish = false being the default (#6153) would make this more likely to be beneficial

Inspired by #16161

Advantage

• Help users better understand what the version field does

Drawbacks

• Not enough people benefit because publish = true (intentional publish)
• Not enough people benefit because of the publish = true default (not published but haven't told cargo)

Example

[package]
name = "foo"
publish = false

[dependencies]
serde = { git = "https://github.com/serde-rs/serde.git", version = "1" }

Could be written as:

[package]
name = "foo"
publish = false

[dependencies]
serde = { git = "https://github.com/serde-rs/serde.git" }

Start by tracing Cargo's package manifest validation and dependency handling for the version field, especially when publish = false and a dependency uses git or path. Define the lint behavior from the examples: warn about the unused field in that case, while preserving valid use cases when publishing is intended.