chore(deps): group Cargo minor and patch updates

[TyceHerrman]

Summary

• group Cargo minor and patch version updates into one Dependabot pull request per run
• keep positional major and security updates outside this version-update group
• preserve the existing git2 ignore without adding versioning-strategy or other update restrictions

Rationale

The July Dependabot run opened #3819, #3820, #3821, #3822, and #3823 as separate pull requests that all modified Cargo.lock. They had to merge serially with repeated rebases and CI runs. Grouping future Cargo minor and patch updates reduces those lockfile conflicts and repeated CI work without suppressing eligible updates.

Verification

• git diff --check
• parsed .github/dependabot.yml and asserted the exact group and existing ignore with Ruby YAML
• cargo fmt -- --check
• cargo test --locked
• confirmed the final diff changes only .github/dependabot.yml and CHANGELOG.md