ci: add cargo-deny for dependency auditing

[eliothedeman]

Summary

• Add deny.toml configuration for cargo-deny to audit dependency licenses, vulnerabilities, and sources
• Add a deny CI job that runs in parallel with the existing build job using EmbarkStudios/cargo-deny-action@v2
• Allow WTFPL and CDLA-Permissive-2.0 licenses used by transitive dependencies
• Ignore known unmaintained/vulnerable transitive dependencies (starlark deps, tar, rustls-webpki) pending upstream fixes

Test plan

• Verify cargo deny check passes locally with no errors
• Verify the deny CI job runs successfully in the PR checks
• Confirm the deny job runs in parallel with build (not sequentially)