Drop Dependabot's versioning strategy for cargo

[dduugg]

Summary

• Dependabot has rejected .github/dependabot.yml since Warn about files that don't parse, read <%== in ERB, and release 0.7.0 #72, so it has run no updates. For cargo it accepts only auto and lockfile-only as a versioning-strategy. Warn about files that don't parse, read <%== in ERB, and release 0.7.0 #72's increase failed with "did not match one of the following values: lockfile-only, auto", and Commit Cargo.lock #74's increase-if-necessary fails the same way (check on main).
• This drops the setting. With no strategy set, dependabot-core's cargo update checker uses BumpVersionsIfNecessary (source). It updates Cargo.lock, and raises a requirement in Cargo.toml only for a release that the requirement doesn't allow, which is what Commit Cargo.lock #74 meant to choose.
• A comment says why no strategy is set, so it isn't added back.

Test plan

• The file still validates against SchemaStore's Dependabot schema (check-jsonschema --builtin-schema vendor.dependabot). That schema doesn't encode cargo's two values, though: it passes the file on main too.
• Dependabot's config check passes on main once this merges. It runs only on the default branch, so this PR can't show it.