Fix Dependabot cargo security updates for non-rust-vmm crates

[Copilot]

Dependabot security updates for Cargo were failing with all_versions_ignored on non-rust-vmm dependencies such as serde_with. The failure came from overlapping Cargo update rules for the same directories, where the restrictive allowlist was selected first.

• Dependabot config

  • Collapse the duplicate Cargo entries for / and /fuzz into a single update rule.
  • Keep Cargo security updates enabled for all dependencies with:

    allow:
      - dependency-type: all

• Grouping behavior

  • Preserve the intended split between rust-vmm and everything else by expressing it as groups within the single Cargo rule.
  • Define rust-vmm with explicit dependency patterns.
  • Define non-rust-vmm as a catch-all group with matching exclude-patterns so crates like serde_with are no longer filtered out by config shape.

• Behavioral impact

  • Security advisories for non-rust-vmm Cargo dependencies can now generate updates instead of failing during Dependabot processing.
  • Existing cooldown settings and grouping intent remain intact.

groups:
  rust-vmm:
    patterns:
      - "acpi_tables"
      - "kvm-bindings"
      # ...
  non-rust-vmm:
    patterns:
      - "*"
    exclude-patterns:
      - "acpi_tables"
      - "kvm-bindings"
      # ...