Pin nightly to nightly-2025-11-08 for the dependency check (#7086)

Versions after that removed the `--build-plan` feature, so we need to
use an older version for dependency-check.  Hopefully this lasts until
we move to moz-central, when we're going to need a new system anyways.

Author: bendk

.github/workflows/dependency-check.yaml

@@ -55,8 +55,6 @@ jobs:
           export PATH="$HOME/.cargo/bin:$PATH"
           source $HOME/.cargo/env
           rustup toolchain install
-          # Needed because `tools/dependency_summary.py` uses nightly
-          rustup toolchain install nightly
       - name: Run Cargo Audit
         run: |
             cargo install cargo-audit --locked

tools/dependency_summary.py

@@ -995,11 +995,7 @@
 
 def subprocess_run_cargo(args):
     """Run `cargo` as a subprocess, returning stdout."""
-    # This script needs to use the `--build-plan` option, hence require cargo nightly.
-    # By using $RUSTUP_TOOLCHAIN to specify this, we can cause rustup to helpfully
-    # download and install the nightly toolchain if it's not already available.
     env = os.environ.copy()
-    env["RUSTUP_TOOLCHAIN"] = "nightly"
     p = subprocess.run(
         ("cargo",) + args,
         env=env,
@@ -1096,6 +1092,9 @@ def get_package_dependencies(self, name, targets=None):
         """
         targets = self.get_compatible_targets_for_package(name, targets)
         cargo_args = (
+            # last nightly that supported --build-plan, details:
+            # https://github.com/rust-lang/cargo/issues/7614
+            "+nightly-2025-11-08",
             "-Z",
             "unstable-options",
             "build",