ci: run cargo deny to check licenses/vulnerabilities

[djc]

We're using the MSRV-aware Cargo resolver, so it doesn't give us updates to vulnerable versions by default if the updates crosses our MSRV threshold.

[codspeed-hq]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing deny (94a60c0) with main (8fbaf77)}