Automatically run cargo update in a workflow

[kylewillmon]

This runs a basic cargo update in a Github Action and creates a PR
with any changes. Combined with limiting Dependabot to major version
updates, this should resolve concerns about too many PRs and being too
strict in our Cargo.toml files.

Ref: Discussion on #325

[cd-work]

Combined with disabling Dependabot for major version
updates

Just to clarify your typo: Dependabot is disabled for everything but major versions. So major versions will still automatically get separate PRs.

I much prefer this over the previous state of things, though one thing that surprises me is that dependabot doesn't have the option to do this on its own? I feel like it should be capable of creating one PR to just bump all the minor stuff without having to define a separate action for it?

[kylewillmon]

Just to clarify your typo: Dependabot is disabled for everything but major versions. So major versions will still automatically get separate PRs.

You are correct... I wrote it backwards. I'll amend to correct it.

I much prefer this over the previous state of things, though one thing that surprises me is that dependabot doesn't have the option to do this on its own? I feel like it should be capable of creating one PR to just bump all the minor stuff without having to define a separate action for it?

The feature was requested a full three years ago in dependabot/dependabot-core#2174, but there hasn't been much progress from what I can tell.

[maxrake]

The workflow name will need to change.

[maxrake]

The output behavior can be observed and tweaked later, if desired.

LGTM