ci: open cargo update PRs with the first-party create-pull-request action

[sds]

Why

peter-evans/create-pull-request handles a token that can push branches and open PRs, and it is a third-party action ahead of the org-only actions policy. tempoxyz/gh-actions ships actions/create-pull-request as its replacement: the commit is created server-side by the STS App and signed by GitHub, nothing is pushed from the runner. voight-kampff already uses it; the same change is proposed for gh-actions' own copy of this workflow.

What changed in cargo-update-pr.yml

• New Detect Cargo.lock changes step after cargo update. The composite fails on an empty diff, so the STS and PR steps now run only when Cargo.lock changed (peter-evans silently did nothing in that case).
• PR step switched to tempoxyz/gh-actions/actions/create-pull-request pinned to gh-actions main at 16356ec5. Inputs map directly: token, branch, title, body, add-paths. author/committer are dropped because the token's actor authors the commit.
• The composite takes a single-line commit headline, so the commit message is the PR title; the cargo update log remains in the PR body. The unused commit_message output was removed.

Callers of this reusable workflow need no changes; permissions and the cargo-update-pr STS policy are unchanged. actionlint and zizmor report no new findings.