Use lockfile-only for cargo dependabot

Previously the dependabot for cargo was using `auto` which would update
both the manifest, `Cargo.toml` files and the `Cargo.lock` file. Since
this repository is for library crates, we only want to update the lock
file that people develop with. We don't want to update the manifest file
and force consumers to update unnecessarily.

.github/dependabot.yaml

@@ -7,6 +7,7 @@ updates:
   open-pull-requests-limit: 25
   commit-message:
     prefix: "chore(deps)"
+  versioning-strategy: lockfile-only
 
 - package-ecosystem: github-actions
   directory: "/"