rustPlatform.fetchCargoVendor: improve parallel fetching and add timeout

[TomaSajt]

Fixes #397309
Supersedes: #400738

This PR moves over to using concurrent.futures.ThreadPoolExecutor instead of multiprocessing.Pool because we can properly do some fail-early logic with ThreadPoolExecutor.

Also, add timeout=(a,b) to session.get calls, so that we never deadlock the fetcher.
I also lowered the Retry object's retry count down to 3.

---

Note: even though this only touches the FOD part of fetchCargoVendor, this file is used by the non-FOD part as well, so we'll get rebuilds :/

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Defelo]

Tested this on a few packages, LGTM so far. But this should probably go to staging instead of master, right?

[TomaSajt]

I had to request a review manually, because it seems like the ci/OWNERS file is not cascading.

nixpkgs/ci/OWNERS

Lines 194 to 195 in 451aea4

	/pkgs/build-support/rust @zowoq @winterqt @figsoda
	/pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt

The others should probably also be added to the second line in the linked section above.

(Or maybe the easiest thing would be for me to just add myself as an owner for the whole of build-support/rust)