fix(supply-chain): allow the bzip2-1.0.6 licence the 7z decode path needs

[h4x0r]

Widening disk-forensic to 0.11 (the previous commit, which cleared
RUSTSEC-2026-0002) pulled in a dependency this repo had not seen before:

libbz2-rs-sys 0.2.5  <- bzip2 <- sevenz-rust2 <- archive-core
                     <- disk-forensic 0.11.4

cargo deny check licenses rejected it — not for anything wrong with the crate,
but because bzip2-1.0.6 was absent from the allow-list:

error[rejected]: failed to satisfy license requirements
  license = "bzip2-1.0.6"  rejected: license is not explicitly allowed

libbz2-rs-sys is the pure-Rust bzip2 port and carries the permissive BSD-style
bzip2/libbzip2 licence — non-copyleft, in the same class as every other entry
already in this list. The fleet rule is to fix the GATE rather than drop the
capability when full features trip it, and there is direct precedent:
archive-forensic allows this licence with the same reasoning, for the same
7z/tar.bz2 decode path.

Recorded honestly as a policy decision, not a bypass: the entry names the crate,
the chain it arrives through, and why the licence class is acceptable.

Verified by control: with bzip2-1.0.6 removed from the allow-list
cargo deny check licenses exits non-zero; with it, both the licences check and
the full cargo deny check pass.

Worth flagging beyond this repo: only 5 of 93 fleet deny.toml files currently
allow this licence, so any repo that updates to disk-forensic 0.11 will hit the
same rejection.