Replace actions-rs/audit-check with direct cargo audit invocation (…

…#92)

Unfortunately we can't pass an `--ignore` option to cargo-audit via
`actions-rs/audit-check` to ignore the request smuggling vulnerability
in `tiny_http` due to this issue:

actions-rs/audit-check#132

This PR switches to invoking `cargo audit` directly so we can.

.github/workflows/security_audit.yml

@@ -18,8 +18,12 @@ jobs:
  uses: actions/cache@v1
  with:
  path: ~/.cargo/bin
- key: ${{ runner.os }}-cargo-audit-v0.11.2
- - uses: actions-rs/audit-check@v1
+ key: ${{ runner.os }}-cargo-audit-v0.12.1
+ - uses: actions-rs/toolchain@v1
  with:
- args: --ignore RUSTSEC-2019-0031
- token: ${{ secrets.GITHUB_TOKEN }}
+ toolchain: stable
+ override: true
+ - name: Install cargo audit
+ run: cargo install cargo-audit
+ - name: Run cargo audit
+ run: cargo audit --deny-warnings --ignore RUSTSEC-2020-0031