…] Pin binary cargo tools via cargo-run-bin" (bitwarden/sdk-internal#1164)

)

## 🎟️ Tracking

- https://bitwarden.atlassian.net/browse/PM-38720
- https://bitwarden.atlassian.net/browse/VULN-613 (dependency approval)
- https://bitwarden.atlassian.net/browse/PM-29567 (original ticket)

## 📔 Objective

Re-introduce the `cargo-run-bin` pinning that was merged in #1143 and
reverted in #1164 pending AppSec dependency approval.

`cargo-run-bin` is now approved (VULN-613) with one explicit condition:
do not configure the `cargo-binstall` integration. This PR re-applies
the original work and adds the binstall guard that condition requires.

## What's in this PR

1. **The original cargo-run-bin work** (cherry-picked from #1143 + its
three follow-up fixes that got the lint matrix green):
- Pin every binary cargo tool used by CI and `scripts/lint.sh` in one
place (root `Cargo.toml` `[workspace.metadata.bin]`), invoked via `cargo
bin <tool>`.
- Pass clippy `-D warnings` on the command line rather than via the
step's `RUSTFLAGS` (avoids leaking into the from-source builds of
`clippy-sarif`/`sarif-fmt`).
- dylint: invoke `cargo-dylint` directly with the real `dylint-link` on
an absolute PATH (bypassing cargo-run-bin's PATH shim, which fails from
`support/lints`); build only the two tools dylint needs.
- Dedicated `actions/cache` for `.bin`, keyed per check on `Cargo.toml`
+ `rust-toolchain.toml`.

2. **New: binstall guard** (`scripts/check-no-binstall.sh`):
- cargo-run-bin uses `cargo-binstall` when EITHER a `binstall` alias is
set in `.cargo/config.toml`, OR `cargo-binstall` is on PATH — pulling
pre-built binaries from third-party mirrors (QuickInstall) instead of
building from auditable crates.io sources.
- Fails the build if the `binstall` alias is configured (always blocking
— this is what we control in the repo).
- In CI (`GITHUB_ACTIONS=true`), fails if `cargo-binstall` is on PATH.
Locally, prints a warning instead — we can't police individual dev
machines, but devs are told.
- Wired into `scripts/lint.sh` `require_cargo_bin` and added as an
explicit step after `Install cargo-run-bin` in every workflow that uses
`cargo bin`.

## 🚨 Breaking Changes

None for product code. CI/dev tooling only.

## Test plan

- [ ] All lint matrix checks pass (clippy, dylint, sort, udeps, ...).
- [ ] `build-android`, `build-rust-crates`, `check-powerset`,
`rust-test`, `version-bump` workflows still pass.
- [ ] `npm run lint` works locally with `cargo-run-bin` installed.
- [ ] The new "Check cargo-binstall is not configured" step appears (and
passes) in every affected workflow.
- [ ] (Manual) Adding `binstall = "binstall"` under `[alias]` in
`.cargo/config.toml` makes the script (and CI) fail.