Prepare Rust for test automations (#20557)
The network-disabled rebase sandbox cannot install the pinned Rust
toolchain, fetch missing dependencies, or provide `cargo-nextest` after
it checks out a pull request; [a failed rebase
job](https://github.com/astral-sh/uv-dev/actions/runs/29608044060/job/87976060317)
shows the read-only Rustup directory and missing dependencies. Prepare
the toolchain, restore the read-only Rust cache, fetch locked
main-branch dependencies, and install `cargo-nextest` before fetching or
checking out the pull request so PR-controlled Cargo configuration stays
outside trusted setup. Keep the same pinned `cargo-nextest` action
available to the security-review job.
Co-authored-by: Zanie Blue <contact@zanie.dev>