CI: Disallow all warnings in cargo deny and prune unmatched skips

[MarijnS95]

Connections
Split out from #6876

Description
The warnings right now all entail unmatched-skip / unmatched-skip-root that have (likely) gotten stale since various automated Renovate bumps where Cargo.lock changes don't require the corresponding unmatched duplicate to be removed from .deny.toml again.

An exception has been made for unmatched-organization since we don't always have a git dependency on a fork in gfx-rs, resulting in a warning about that orga being in sources.allow-org.github.

Testing
Locally:

$ cargo deny --all-features --workspace check -Dwarnings -Aunmatched-organization

Squash or Rebase?

Rebase

Checklist

• Run cargo fmt.
• Run taplo format.
• Run cargo clippy --tests. If applicable, add:
  • --target wasm32-unknown-unknown
• Run cargo xtask test to run tests.
• If this contains user-facing changes, add a CHANGELOG.md entry.

[MarijnS95]

Here it is failing as expected:

https://github.com/gfx-rs/wgpu/actions/runs/18142774695/job/51637459656?pr=8283

Also yikes: why is that reinstalling the toolchain on 1.88, shouldn't cargo-deny work without that if the container action was built prior?

[ErichDonGubler]

LGTM!

[ErichDonGubler]

Squash or Rebase?

Rebase

If there were multiple commits in this PR, I'd understand this request, but squash-and-merging for single commits has been really helpful for contributors wanting to track where contributions came from WRT PRs. Is there a reason I shouldn't squash-and-merge this?

[MarijnS95]

I should have probably removed that (= my default) answer and this question entirely as the context in which it is asked is irrelevant for single-commit PRs. It really doesn't matter, and if it helps folks see the (#8283) suffix (GitHub will show it for arbitrary commits too) a squash is totally fine.