Collect Rust licenses from Cargo.toml before querying crates.io #26

What

The Rust metadata collector currently queries crates.io for license information. Request failures are silently ignored, which can produce different license values between builds of the same component.

Example from reference_integration:

While reference_integration/bazel-reference_integration/external/rules_rust++crate+crate_index__quote-1.0.47/Cargo.toml contains:

...
categories = ["development-tools::procedural-macro-helpers"]
license = "MIT OR Apache-2.0"
repository = "https://github.com/dtolnay/quote"
...

Acceptance Criteria (DoD)

• Direct manifest license expressions take precedence over API metadata.
• Manifests are declared Bazel action inputs, with their repository association preserved.
• Different versions of a crate receive metadata from their respective sources.
• A manifest identity mismatch is reported and is not silently hidden by fallback.
• No license API request is made when a usable local expression is available.
• API fallback uses rate limiting, bounded retries for transient failures and explicit error reporting.
• The collected value records its origin: manifest or API.
• Unresolved licenses distinguish API failures and responses without a license.

How

Proposed behaviour

1. Locate the manifest associated with the selected Bazel dependency.
2. Verify its package identity against the selected component.
3. Read package.license when it contains a non-empty string.
4. Otherwise, request the license for the exact crate name and version from crates.io.
5. If collection remains unsuccessful, report the reason explicitly.