chore: improve dependency maintenance

[thomasjiangcy]

Summary

• add cargo-deny policy for advisories, licenses, duplicate-version visibility, and source allowlisting
• add cargo-machete unused dependency checks to local and CI gates
• pin dependency tooling in mise and CI, use locked Cargo checks, and group Cargo Dependabot patch/minor updates
• add package metadata for license, repository, and description

Verification

• mise exec -- just ci

Note: cargo-deny currently reports duplicate-version warnings for transitive getrandom and openssl-probe versions; the policy leaves duplicates as warnings so the gate can surface them without blocking unrelated maintenance.