ci: enforce dependency and license policy

[shayyz-code]

Add enforceable dependency, advisory, license, and source checks before external Rust or native runtime dependencies enter the project.

Acceptance criteria:

• Add a strict cargo-deny policy for all supported targets and features.
• Run the policy on pull requests, manually, and on a weekly schedule.
• Document Cargo and native dependency review requirements.
• Enable Dependabot vulnerability alerts without automatic update pull requests.
• Require the dependency policy check on main.
• Preserve the issue-first workflow and existing release targets.