[ANE-512] Fix Cargo analyzer reporting library as dependency of itself

[ryanlink]

Overview

This PR fixes a bug where the Cargo analyzer incorrectly reports library projects as dependencies of themselves when they have no external dependencies. The issue occurred because the buildGraph function treated all workspace members as direct dependencies without filtering out isolated workspace members from the final dependency graph.

This PR accomplishes the fix by using Graphing.shrink to selectively filter out workspace members that have no external dependencies, while preserving workspace members that do have legitimate external dependencies.

Acceptance criteria

When users analyze Cargo projects that are library crates with no external dependencies, the dependency graph should now show zero dependencies instead of incorrectly showing the project as a dependency of itself.

For example, analyzing the unempty library project now correctly returns:

{"graph":{"deps":[],"direct":[]}}

Instead of the previous incorrect result:

{"graph":{"deps":[{"name":"unempty","version":"1.0.0"}]}}

Testing plan

1. Reproduced the original issue:

   • Cloned the test project: git clone https://github.com/jssblck/unempty.git && cd unempty && git checkout 164eae5e76cc3b17bd9d59f647e62b5b9b10785c
   • Ran analysis with original code: fossa analyze --output | head -1
   • Confirmed it showed self-dependency issue

2. Verified the fix:

   • Applied the changes to src/Strategy/Cargo.hs
   • Built the CLI: make build-cli
   • Ran analysis on same test project: fossa analyze --output | head -1
   • Confirmed it now shows "deps":[] (zero dependencies)

3. Ensured backward compatibility:

   • Ran existing unit tests: cabal test unit-tests --test-option="--match" --test-option="should build the correct graph"
   • Verified that Cargo projects with legitimate external dependencies still work correctly
   • Confirmed the Cargo metadata parser tests continue to pass

4. Code quality checks:

   • Ran linting: make lint (HLint passed)
   • Ran formatting: make fmt (Fourmolu passed with automatic fixes)
   • Ran full unit test suite: reduced failure count from 30 to 29 (our Cargo test now passes)

Risks

The main risk area is ensuring the filtering logic correctly distinguishes between:

1. Isolated workspace members (should be filtered out) - those with no external dependencies
2. Workspace members with dependencies (should be preserved) - those that have legitimate external dependencies

I've implemented this by checking if a workspace member has any dependencies in the resolve graph using hasNoDependencies. Reviewers should verify this logic correctly handles edge cases and doesn't break existing workspace functionality.

Metrics

This change fixes a functional bug rather than introducing new functionality, so no new metrics are needed. The fix can be validated by:

• Monitoring for reduced reports of self-dependency issues in support tickets
• Verifying existing Cargo workspace analysis continues to work correctly

References

• ANE-512: Original Jira issue
• ANE-216: Related issue about Cargo workspace dependency handling
• unempty test case: Reproduction case

Checklist

• I added tests for this PR's change (or explained in the PR description why tests don't make sense).
• If this PR introduced a user-visible change, I added documentation into docs/.
• If this PR added docs, I added links as appropriate to the user manual's ToC in docs/README.ms and gave consideration to how discoverable or not my documentation is.
• If this change is externally visible, I updated Changelog.md. If this PR did not mark a release, I added my changes into an ## Unreleased section at the top.
• If I made changes to .fossa.yml or fossa-deps.{json.yml}, I updated docs/references/files/*.schema.json AND I have updated example files used by fossa init command. You may also need to update these if you have added/removed new dependency type (e.g. pip) or analysis target type (e.g. poetry).
• If I made changes to a subcommand's options, I updated docs/references/subcommands/<subcommand>.md.