fix(ci): resolve dependency review license detection issues

Add allow-list for dependencies with undetected licenses:
- [email protected]: Actually MIT/Apache-2.0 licensed
- [email protected]: Actually Apache-2.0 licensed

The dependency-review-action has trouble detecting licenses for these
crates automatically. Since we've manually verified they use allowed
licenses, we explicitly allow them to prevent CI failures.

Author: avrabe

.github/workflows/security-audit.yml

@@ -135,4 +135,9 @@ jobs:
       - uses: actions/dependency-review-action@v4
         with:
           fail-on-severity: high
-          allow-licenses: MIT, Apache-2.0, BSD-3-Clause, ISC, MPL-2.0, Unlicense
+          allow-licenses: MIT, Apache-2.0, BSD-3-Clause, ISC, MPL-2.0, Unlicense
+          # Allow dependencies with undetected licenses that we've manually verified
+          # chrono is MIT/Apache-2.0, dagger-sdk is Apache-2.0
+          allow-dependencies-licenses: |
+            pkg:cargo/[email protected]
+            pkg:cargo/[email protected]