ci: add RustSec security audit and cargo-deny checks

[bistack]

Summary

Add security audit infrastructure using RustSec advisory database to CI:

• security-audit.yml: runs cargo-audit to scan Cargo.lock for known vulnerabilities (non-blocking)
• cargo-deny.yml: checks advisories, dependency bans, licenses, and sources
• audit.toml: cargo-audit configuration
• deny.toml: cargo-deny configuration (allowed licenses, sources)
• README.md: add Security audit and cargo-deny status badges

Changes

• New CI workflow: security-audit.yml using actions-rust-lang/audit@v1
• New CI workflow: cargo-deny.yml using EmbarkStudios/cargo-deny-action@v2
• Both workflows run on PR, push to main/master, and weekly schedule
• Security audit is non-blocking (continue-on-error: true)

Testing

• cargo fmt check passed
• cargo audit run locally (found 2 existing vulnerabilities, non-blocking)
• YAML structure validated

[github-actions]

Thanks @bistack for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

[Hmbown]

v0.8.68 harvest triage (lane-perf)

Scouted against main @ 931a1df27.

Decision: do not land as-is for 0.8.68.

• CI is not CI-only red: cargo-audit / cargo-deny (advisories) fail on real lockfile advisories:
  • crossbeam-epoch 0.9.18 → upgrade ≥0.9.20 (RUSTSEC-2026-0204)
  • lopdf 0.38.0 → upgrade ≥0.42.0 (RUSTSEC-2026-0187, severity 7.5)
  • ttf-parser unmaintained warning (RUSTSEC-2026-0192)
• Adding blocking advisory gates without coordinated dependency upgrades will keep main red.
• Workflow/config shape (security-audit.yml with continue-on-error, deny.toml) is useful, but should ship with a green advisory baseline (or explicit temporary ignores + follow-up dep PR).

Suggested next step: separate PR that upgrades/ignores the known advisories first, then land the CI workflows. Credit remains with @bistack.

[Hmbown]

hmm my grok got a bit out of alignment…. I want to get this in the next version, I think this is very smart. thank you!!

[bistack]

@Hmbown Thanks! Happy to make any adjustments if needed.