ci: add cargo-deny and cargo-audit checks

[Mec-iS]

Fixes #489

Checklist

• My branch is up-to-date with main branch.
• Everything works and tested on latest stable Rust.
• Coverage and Linting have been applied

Current behavior

No CI job checks dependencies for security advisories, yanked versions, licenses or unknown sources. Cargo.lock is not in the repository, so a yanked version, such as chacha20 0.10.0, shows only on local machines.

New expected behavior

The new Dependency audit workflow (.github/workflows/audit.yml) has two jobs:

• cargo deny: runs cargo deny --all-features check with the rules in deny.toml.
  • Yanked crates fail the job.
  • Licenses must be Apache-2.0, MIT or Unicode-3.0.
  • Wildcard versions, unknown registries and git sources fail the job.
  • Several versions of one crate give a warning only.
• cargo audit: runs cargo audit --deny yanked --deny unsound on a fresh lockfile. Vulnerabilities fail the job. An unmaintained crate gives a warning only.

The workflow runs on push to main, on pull requests, every Monday, and on manual start. The weekly run finds new advisories when no one changes the code.

deny.toml has one ignore entry: RUSTSEC-2023-0089 (atomic-polyfill is unmaintained). The crate is in the tree only through postcard -> heapless, and postcard is a dev-dependency. It is not in the published crate.

deny.toml is added to the exclude list in Cargo.toml, so it is not in the published package.

Validation

I ran these checks locally with cargo-deny 0.20.2 and cargo-audit 0.22.2, on a fresh lockfile:

• cargo deny check: advisories ok, bans ok, licenses ok, sources ok.
• cargo audit --deny yanked --deny unsound: passes (one allowed warning for atomic-polyfill).
• With the lockfile set back to chacha20 0.10.0 (cargo update -p chacha20 --precise 0.10.0), both tools fail the check for the yanked crate.
• cargo package --list does not include deny.toml.

Change logs

Added

• Dependency audit CI workflow (cargo deny and cargo audit).
• deny.toml with the rules.

Changed

• deny.toml is in the exclude list in Cargo.toml.