fix(ci): switch from cargo-audit to cargo-deny for advisory scanning

[codefromthecrypt]

Summary

Switch CI from cargo-audit to cargo-deny for advisory scanning. cargo-deny uses the actual dependency graph instead of scanning the lockfile, which eliminates false positives like the rsa advisory from unused sqlx-mysql.

Type of Change

• Security fix
• Build / Release

AI Assistance

• This PR was created or reviewed with AI assistance

Testing

cargo deny check advisories

Related Issues

Follows up on #7031

[Copilot]

Pull request overview

Switches the repository’s advisory/vulnerability scanning in CI from cargo-audit to cargo-deny, aligning scanning with the actual resolved dependency graph to reduce lockfile-only false positives.

Changes:

• Add a minimal deny.toml configuring cargo-deny advisory behavior (deny yanked; ignore unmaintained/unsound).
• Update the existing audit workflow to run EmbarkStudios/cargo-deny-action with check advisories and adjust triggers accordingly.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
deny.toml	Adds cargo-deny advisories configuration to emulate prior cargo-audit behavior.
.github/workflows/cargo-audit.yml	Replaces the cargo-audit GitHub Action with cargo-deny advisory checks and updates config trigger path.

[codefromthecrypt]

@michaelneale figure you might care about this.. main difference here is it is more precise about deps actually used. it makes it more clear that things that are unmaintained are not audited, though I think we could revisit that. It might be a fool's errand to try to make goose solely depend on maintained things as it applies transitively