fix(cargo): propagate timeout error and increase default from 5s to 120s

The 5-second default was insufficient for initial crates.io index
downloads, especially on Windows CI. Errors were silently swallowed in
addDependencies(), producing empty SBOMs instead of reporting failures.

Now timeout errors propagate as RuntimeException with a message that
references the trustify.cargo.timeout.seconds system property so users
know how to adjust it.

Implements TC-4165

Assisted-by: Claude Code

Author: ruromero

src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java

@@ -72,7 +72,7 @@ public final class CargoProvider extends Provider {
   private static final String PACKAGE_VERSION_WORKSPACE = "package.version.workspace";
   private static final String WORKSPACE_PACKAGE_VERSION = "workspace.package.version";
   private static final long TIMEOUT =
-      Long.parseLong(System.getProperty("trustify.cargo.timeout.seconds", "5"));
+      Long.parseLong(System.getProperty("trustify.cargo.timeout.seconds", "120"));
   private final String cargoExecutable;
 
   private CargoProjectLayout getProjectLayout(CargoMetadata metadata) {
@@ -147,7 +147,8 @@ private void addDependencies(
       }
 
     } catch (IOException | InterruptedException e) {
-      log.severe("Unexpected error during " + analysisType + " analysis: " + e.getMessage());
+      throw new RuntimeException(
+          "Failed during " + analysisType + " analysis: " + e.getMessage(), e);
     }
   }
 
@@ -438,7 +439,10 @@ private CargoMetadata executeCargoMetadata() throws IOException, InterruptedExce
         process.destroyForcibly();
         outputFuture.cancel(true);
         errorFuture.cancel(true);
-        throw new InterruptedException("cargo metadata timed out after " + TIMEOUT + " seconds");
+        throw new InterruptedException(
+            "cargo metadata timed out after "
+                + TIMEOUT
+                + " seconds. Adjust with -Dtrustify.cargo.timeout.seconds=N");
       }
 
       try {