Add text_direction_codepoint lint (CVE-2021-42574)

[enthropy7]

What does this PR try to resolve?

This PR implements the text_direction_codepoint lint for Cargo.toml files:
Fixes #16373 and #16374

lint detects Unicode BiDi (bidirectional) control codepoints that can be used in "Trojan Source" attacks. These invisible characters can alter the visual display of text without changing its underlying representation, potentially making malicious manifest content appear benign. All like descritped in rustc's text_direction_codepoint_in_comment/literal lint but for Cargo manifests.

Detected codepoints:

• U+202A LEFT-TO-RIGHT EMBEDDING
• U+202B RIGHT-TO-LEFT EMBEDDING
• U+202C POP DIRECTIONAL FORMATTING
• U+202D LEFT-TO-RIGHT OVERRIDE
• U+202E RIGHT-TO-LEFT OVERRIDE
• U+2066 LEFT-TO-RIGHT ISOLATE
• U+2067 RIGHT-TO-LEFT ISOLATE
• U+2068 FIRST STRONG ISOLATE
• U+2069 POP DIRECTIONAL ISOLATE

Default level: deny

How to test and review this PR?

cargo test -p cargo --test testsuite -- lints::text_direction_codepoint
Manual testing:

Create a manifest with BiDi codepoint (U+202E)

printf '[package]\nname = "foo"\nversion = "0.1.0"\nedition = "2024"\ndescription = "A \xE2\x80\xAEtest"\n' > Cargo.toml
mkdir -p src && echo 'fn main(){}' > src/main.rs
cargo +nightly check -Zcargo-lints

The lint can be configured via [lints.cargo]:

[lints.cargo]
text_direction_codepoint = "allow"  # or "warn"

[rustbot]

r? @weihanglo

rustbot has assigned @weihanglo.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

[enthropy7]

need2test a little bit more