Review cargo-deny configuration

[alce]

I recently had to wrestle cargo-deny for a PR to pass CI. In the process, it helped getting rid of duplicate rand versions, which is not an essential dependency for Tonic.

On the other hand, I had to allow multiple versions of crossbeam-queue to exist in the dependency tree. I think this is ok for now but we may want to revisit deny.toml once we upgrade tokio, futures and other essential dependencies.

cc #93

[Jake-Shadle]

Note that cargo deny will show warnings if you've specified to skip a particular crate + version that isn't found in the dependency graph so that you can clean up configs as your dependency graph changes.