Cargo detector needs to consider if dependencies are optional or not

[jcfiorenzano]

Cargo dependencies can be flagged as optional. These are dependencies that will be included in the final artifact if certain features defined by it are enabled. See https://doc.rust-lang.org/cargo/reference/features.html#optional-dependencies. We should at least register this property as we do with the Maven detector and its scope property.

We could also evaluate the use of the cli tool cargo tree . We need to investigate if running cargo tree --edge all returns optional dependencies that are not active, if it doesn't then we could use to remove the dependencies from the component detection report.

[grvillic]

Cargo's new SBOM format resolves this issue about optional dependencies. We already have a SBOM Cargo detector in experimental stage (#1387) and plan to ship it within the next few months once we have validated its accuracy and performance.

[grvillic]

This is already resolved in #1478. RustSBOM detector has been promoted to production and documentation has been added in https://github.com/microsoft/component-detection/blob/main/docs/detectors/rust.md