ci: add cargo-deny for license compliance and supply chain policy

[nfvelten]

Migrated from nfvelten/arbitus#130

Summary

cargo audit (tracked in #55) catches known CVEs. cargo deny goes further: it enforces allowed licenses, blocks duplicate dependencies, and checks against the RustSec advisory database — all in one step.

Implementation

# .github/workflows/ci.yml
- name: Check licenses and supply chain
  run: |
    cargo install cargo-deny --locked
    cargo deny check

Add deny.toml at repo root:

[advisories]
vulnerability = "deny"
unmaintained = "warn"

[licenses]
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-DFS-2016"]
deny = ["GPL-2.0", "AGPL-3.0"]

References

• PROPOSAL.md §7.5