feat(cargo): dependency version inspections and updates (#684)

Cargo.toml had no way to tell that a dependency had a newer release.

Dependencies in [dependencies], [dev-dependencies], [build-dependencies], target tables and [workspace.dependencies] now get a weak warning when the newest stable release is outside the version requirement, with a quick fix that rewrites the requirement at its original precision ("0.7" → "0.10") in both string and inline-table forms. Versions complete inside the version string, newest first, without yanked releases. Path, git and workspace-inherited dependencies are skipped, prereleases are only suggested to prerelease requirements, and failures stay silent.

Versions come from the crates.io sparse index through the backend's HTTP client, with an in-memory and on-disk cache and coalesced requests, behind a dependency version source shared by file-type parsers so other manifests can be added later. semver is now used directly; it was already linked into the app.

Fixes #479

src/platform/inspections.ts

@@ -222,6 +222,9 @@ export interface BuiltinInspection {
 export const SPELLING_PRODUCER = "spelling";
 export const SPELLING_INSPECTION = "builtin:spelling";
 
+export const DEPENDENCY_PRODUCER = "dependency-versions";
+export const DEPENDENCY_INSPECTION = "builtin:dependency-versions";
+
 /** IDEA's Typo options: which parts of source files are checked (plain text always is). */
 export const SPELLING_OPTIONS = {
   code: "processCode",
@@ -231,6 +234,14 @@ export const SPELLING_OPTIONS = {
 
 /** Checks the IDE runs itself (not a language server). */
 export const BUILTIN_INSPECTIONS: readonly BuiltinInspection[] = [
+  {
+    id: DEPENDENCY_INSPECTION,
+    producer: DEPENDENCY_PRODUCER,
+    name: "Newer dependency version available",
+    group: "Cargo",
+    description: "Reports newer crate versions that Cargo.toml requirements do not already allow.",
+    defaultLevel: "weakWarning",
+  },
   {
     id: "builtin:file-references",
     producer: "file-references",

src/platform/locales/text/zh.json

@@ -1,4 +1,8 @@
 {
+  "Newer dependency version available": "有更新的依赖版本可用",
+  "Reports newer crate versions that Cargo.toml requirements do not already allow.": "报告 Cargo.toml 版本要求尚未允许的较新 crate 版本。",
+  "Update to {latest}": "更新至 {latest}",
+  "A newer version is available: {latest}": "有新版本可用：{latest}",
   "Kotlin bridge requires a Maven build root": "Kotlin 桥接需要 Maven 构建根目录",
   "Kotlin bridge bundle is unavailable": "Kotlin 桥接扩展不可用",
   "Kotlin bridge command did not acknowledge its library snapshot": "Kotlin 桥接命令未确认类库更新",

src/platform/locales/textCatalog.test.ts

@@ -80,6 +80,7 @@ const BUILT_AT_RUNTIME = new Set<string>([]);
 /** Text that stays as written in every locale: names, code, formats, shortcuts. */
 const UNTRANSLATED = new Set<string>([
   // Product names
+  "Cargo",
   "CMake",
   "Prettier",
   "IntelliJ IDEA",