ci: add cargo-deny workflow for license and advisory checks

[kitsuyui]

Summary

Adds .github/workflows/deny.yml to wire the existing deny.toml into CI as a fail-close audit gate.

• Runs EmbarkStudios/cargo-deny-action@v2 on every PR and push to main
• Checks license compliance, banned crates, and security advisories defined in deny.toml
• Kept as a dedicated workflow (separate from test.yml) for clear separation of concerns

Changes

• .github/workflows/deny.yml — new workflow that runs cargo deny check on PR / push to main

Verification

deny.toml was added in #112 with the following policy:

• licenses: MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-3-Clause, ISC, Unicode-3.0, OpenSSL
• advisories: deny known vulnerabilities (RUSTSEC advisory DB)
• bans: warn on multiple versions
• sources: crates.io only

This workflow exercises that config on every PR and main push, failing CI if a dependency violates the policy.

Trade-offs

Action references use the same tag-ref style (@v6, @v2) as the existing test.yml. SHA pinning for actions is a separate concern and not introduced here.

[github-actions]

Code Metrics Report

	main (0c91c43)	#119 (6ce2e0a)	+/-
Coverage	68.3%	68.3%	0.0%
Code to Test Ratio	1:0.1	1:0.1	0.0
Test Execution Time	3s	6s	+3s

Details

  |                     | main (0c91c43) | #119 (6ce2e0a) | +/-  |
  |---------------------|----------------|----------------|------|
  | Coverage            |          68.3% |          68.3% | 0.0% |
  |   Files             |              4 |              4 |    0 |
  |   Lines             |            550 |            550 |    0 |
  |   Covered           |            376 |            376 |    0 |
  | Code to Test Ratio  |          1:0.1 |          1:0.1 |  0.0 |
  |   Code              |            593 |            593 |    0 |
  |   Test              |             71 |             71 |    0 |
- | Test Execution Time |             3s |             6s |  +3s |

---

Reported by octocov