14. Add Rust dependency vulnerability scanning with cargo-audit

[Husten150]

Problem

The SECURITY.md is very large (180KB). There is no automated vulnerability scanning for Rust dependencies in CI.

Requirements

• Add cargo-audit to CI for dependency vulnerability scanning
• Add cargo-deny for license compliance and duplicate dependency checks
• Create .cargo/deny.toml configuration:
  • Deny GPL/AGPL licenses
  • Allow MIT, Apache-2.0, BSD
  • Ban duplicate versions of same crate
• Make vulnerability scanning BLOCKING for critical severity

Pipeline Test

• Add CI job security-audit:
  • cargo audit (fail on critical/high vulnerabilities)
  • cargo deny check (license compliance)
  • cargo deny check bans (duplicate deps)
  • Upload audit report as artifact

Acceptance Criteria

• Zero critical vulnerabilities in dependencies
• All dependencies use approved licenses
• No duplicate crate versions
• CI blocks on security findings