Add a `manifest` path to each `dependencies[]` row

[andrew]

manifests[] lists every discovered manifest with its path, but dependencies[] is a flat union across all of them with no field saying which file each row came from. A repo with more than one lockfile produces indistinguishable rows:

$ brief --json https://github.com/vercel/next.js | jq '[.manifests[]|select(.ecosystem=="cargo" and .kind=="lockfile")|.path]'
["Cargo.lock","scripts/send-trace-to-jaeger/Cargo.lock"]
$ brief --json https://github.com/vercel/next.js | jq -c '.dependencies[]|select(.name=="h2")'
{"name":"h2","version":"0.3.24","purl":"pkg:cargo/h2@0.3.24","scope":"runtime","direct":false}
{"name":"h2","version":"0.4.7","purl":"pkg:cargo/h2@0.4.7","scope":"runtime","direct":false}
{"name":"h2","version":"0.3.7","purl":"pkg:cargo/h2@0.3.7","scope":"runtime","direct":false}

h2@0.3.24 and h2@0.4.7 are from the root Cargo.lock (compiled into the published @next/swc-* binaries); h2@0.3.7 is from scripts/send-trace-to-jaeger/Cargo.lock (a dev script). A caller checking advisories against pkg:npm/next cannot tell them apart without re-reading the lockfiles itself.

Adding "manifest": "scripts/send-trace-to-jaeger/Cargo.lock" to each row (mirroring manifests[].path) would let callers scope dependencies to the artefact they care about. git-pkgs/git-pkgs already stores manifest_id on dependency_snapshots for the same reason.