Transitive dependencies are considered when using `Cargo.lock`

[Calsign]

As part of properly supporting Cargo.lock (# gazelle:rust_cargo_lockfile Cargo.lock) from cargo in #14, the logic for extracting the list of dependencies from Cargo.lock changed to include all packages, including transitive dependencies:

gazelle_rust/rust_parser/lockfile_crates.rs

Lines 87 to 98 in a1fa7a7

	for pkg in lockfile.packages {
	if !is_workspace_target(pkg.name.as_str()) {
	let mut package = Package::default();
	package.name = pkg.name.as_str().to_string();
	package.crate_name = package.name.replace('-', "_");
	package.proc_macro = pkg
	.dependencies
	.iter()
	.any(|dep| is_proc_macro_dep(dep.name.as_str()));
	crates.push(package);
	}
	}

This causes two issues when using gazelle:rust_cargo_lockfile:

• unused dependency reporting (only enabled if a patch to gazelle is applied) incorrectly lists all transitive dependencies as unused
• if user code newly depends on a crate which is not listed as a top-level dependency but is a transitive dependency, gazelle will incorrectly add a dependency on the non-existent target for that crate which will break the build

Options for trying to fix this include:

• Using direct-cargo-bazel-deps when it exists
• Determining the set up workspace crates and only adding their dependencies to the list
• Parsing Cargo.toml to determine the set of top-level dependencies