fix(cargo-workspace): don't release publish = false members pulled in as dependents

[nazq]

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #1980 🦕

Problem

With the cargo-workspace plugin, every workspace member is pulled into the dependency graph and version-bumped when a dependency is bumped — including crates marked publish = false. When separate-pull-requests is enabled, a publish = false crate that only appears as a transitive dependent gets its own standalone release pull request (and tag / manifest entry), even though it is never published anywhere. This produces an empty, noisy release PR on every release.

This is the request in #1980. The discussion there raised a valid concern: some teams do want their publish = false crates released (version bumped, GitHub release made) — publish = false only means "don't push to a registry". So a blanket "skip all publish = false crates" would be wrong.

Solution

Suppress the standalone release only for a publish = false crate that is pulled in solely as a dependent (i.e. it has no release candidate of its own):

• It is still version-bumped, so its dependents' Cargo.toml entries and the lockfile stay consistent.
• It gets no release pull request, tag, or .release-please-manifest.json entry.

Teams that want a publish = false crate released simply list it in their release-please packages config as usual — it then has its own release candidate, and this new behavior does not apply to it. Both camps from #1980 are satisfied with no new configuration.

Implementation

• Adds a shouldCreateReleasePullRequest(pkg) hook to the base WorkspacePlugin (defaults to true, so node-workspace and maven-workspace are unchanged).
• CargoWorkspace overrides it to return false for crates whose manifest sets publish = false.
• The hook is consulted only on the dependent-only path (no existing candidate), and gates both candidate creation and the manifest (updatedPathVersions) entry — the version bump itself is unaffected.

Tests / docs

• New fixture (test/fixtures/plugins/cargo-workspace-publish-false) and test asserting a publish = false dependent is not turned into a release PR.
• Existing cargo-workspace / node-workspace / maven-workspace suites unchanged and passing.
• docs/manifest-releaser.md cargo-workspace section documents the behavior.