feat(ci/cd): Add `cargo deny` as a pre-merge CI check

[ryerraguntla]

Description

Type: ci / security
Labels: security, ci, dependencies, A-tooling
Source: discussion #3678

Summary

Wire cargo deny into the pre-merge CI pipeline
(.github/actions/rust/pre-merge) so every PR is gated on advisory scanning,
license policy, banned crates, and duplicate-version detection across the full
dependency graph. Mirror the check in the local pre-commit config so
contributors catch failures before pushing.

Motivation

cargo audit only covers known vulnerabilities. cargo deny is a superset
gate: in addition to RustSec advisories it enforces open-source license policy,
bans specific crates, and flags duplicate dependency versions. A pre-merge gate
prevents new advisories and policy violations from re-entering the tree after the
one-time remediation (sibling audit issue) lands.

Reference: https://github.com/EmbarkStudios/cargo-deny

Affected area / component

Other / not sure

Proposed solution

Proposed approach

1. Add a committed deny.toml at repo root with sections:
   • [advisories] — deny vulnerabilities/unsound; explicit ignore list for
     accepted-risk advisories (each with a comment + review date). Seed from the
     audit-remediation issue outcomes.
   • [licenses] — allowlist ASF-compatible licenses (Apache-2.0, MIT,
     BSD-2/3-Clause, ISC, Unicode-DFS, etc.); confirm against the existing
     scripts/ci/third-party-licenses.sh policy so the two do not conflict.
   • [bans] — flag duplicate versions (multiple-versions = "warn" initially,
     then deny once the tree is deduplicated); ban known-bad crates.
   • [sources] — restrict to crates.io + explicitly allowed git sources.
2. Add a CI step running cargo deny check (advisories, licenses, bans, sources)
   inside .github/actions/rust/pre-merge/action.yml, ordered after the existing
   Rust verification steps.
3. Add a scripts/ci/cargo-deny.sh wrapper (consistent with existing
   scripts/ci/*.sh) and wire it into .pre-commit-config.yaml.

Alternatives considered

No response

Contribution

• I'm willing to submit a pull request to implement this feature

Good first issue

• I think this could be a good first issue for a new contributor

[ryerraguntla]

**** ==========================================**
** cargo-deny Configuration Template**

 --- 1. Advisory Checks ---**
 Checks for known vulnerabilities or unmaintained crates in the RustSec database.**
[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
Fail the build if a crate with a known vulnerability is found.**
vulnerability = "deny"
 Warn (instead of fail) if a crate is unmaintained or deprecated.**
unmaintained = "warn"
 Warn on yanked crates, as they are no longer officially supported.**
yanked = "warn"
ignore = [
    "RUSTSEC-2021-XXXX" # Uncomment and add specific advisory IDs to ignore**
]

 --- 2. Dependency Bans ---**
 Allows you to explicitly allow, deny, or skip specific crates.**
[bans]
Fail the build if multiple versions of the same crate are used (uncomment to enforce).**
 multiple-versions = "deny"**
 Fail the build if a crate can't be resolved (e.g., missing dependencies).**
highlight = "all"
skip = [
     "some-crate" # Add crates to skip version/ban checks**
]
deny = [
     "unwanted-crate" # Add crates you strictly want to prevent**
]

--- 3. License Checks ---**
 Enforces your open-source or commercial compliance requirements.**
[licenses]
 Fail the build if a dependency doesn't specify a license.**
unlicensed = "deny"
Allow specific popular open-source licenses.**
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
]

Fail the build if a dependency uses a strictly disallowed license.**
deny = [
    "GPL-3.0",
    "AGPL-3.0",
]
 Warn if the license is considered copyleft (requires sharing code).**
copyleft = "warn"
 Allow exception for custom licenses or non-standard naming (specify exact file).**
exceptions = [
    { allow = [" MPL-2.0"], name = "some-crate" }**
]

--- 4. Source Checks ---**
 Controls where your dependencies are allowed to be downloaded from.**
[sources]
 Fail the build if dependencies are from unknown/malicious sources.**
unknown-registry = "deny"
unknown-git = "deny"
allow-org = true
allow-community = true
 Whitelist private or internal registries if applicable.**
allow-git = [
    "https://github.com"
]