ci: add cargo-deny workflow

[avifenesh]

Summary

• Adds .github/workflows/deny.yml running cargo deny check --all-features on pull_request and push to main
• Uses the existing deny.toml introduced in v0.8.0 (fix(security): sidecar OOM caps, secret-file exclusion, SLSA attestations, cargo-deny #37); no policy changes
• Actions pinned by commit SHA (v6.0.2 checkout, v2.0.17 cargo-deny-action)

Why

deny.toml landed in #37 with a comment noting "CI integration is a follow-up; this file establishes the policy". This PR closes that follow-up so the policy is actually enforced.

Test plan

• Workflow runs green on this PR (validates current advisory/license/source state)
• Future dep bumps that introduce a CVE or banned license break CI

---

Note

Low Risk
Low risk: adds a GitHub Actions workflow that runs cargo deny check and does not change application code or dependency policy itself.

Overview
Adds a new GitHub Actions workflow, deny.yml, that runs cargo deny check --all-features on pull requests and pushes to main to enforce the existing deny.toml advisory/license/source policy in CI.

The workflow uses pinned SHAs for actions/checkout and EmbarkStudios/cargo-deny-action and logs at warn level.

^{Reviewed by Cursor Bugbot for commit ef1f03c. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ef1f03c. Configure here.}