v1.7.0 - ci-rust pre-baked image + rust-build + rust-audit templates

Second per-language pre-baked builder image. Mirrors ci-go's
structure: rust:1.85 + cargo-audit + syft + cosign. Authenticated
pull from registry.gitlab.com.

New templates:
- rust-build: branch verification (cargo build + cargo test);
  caches target/ and .cargo/registry between jobs.
- rust-audit: cargo-audit at lint stage; allow_failure (vuln DB
  changes don't block release).

slsa-attest, release-create, and the syft-based SBOM template are
already tech-agnostic and compose with rust-build for tag releases.
A rust-release-binary template will land when patinate (or another
Rust consumer) needs durable binary publishing.

Catalog .gitlab-ci.yml grew a container:ci-rust job (mirrors
container:ci-go) and includes the new rust-* templates for
syntax validation.

Patinate is the reference Rust consumer; bumps in a follow-on commit.

ci-node and a node-build template not added: the existing `ci`
image (Fedora + node + wrangler + aws-cli) already serves the
catalog's Astro consumers via cloudflare-pages. Node templates can
land later if a non-CF-Pages Node consumer materializes.