Add cargo-deny policy checks

[lucarlig]

Summary

• Add a CI job that runs cargo deny check advisories licenses.
• Fix the webpki-root-certs cargo-deny license exception name so the license check can pass.

Why

main already contains the cargo-deny config and dependency changes. After rebasing this PR onto latest main, the remaining CI change exposed that the existing exception used webpki-roots-certs, but the crate in Cargo.lock is webpki-root-certs.

Validation

• cargo deny check advisories licenses passes: advisories ok, licenses ok.

[dawid-nowak]

great stuff