feat(ci):Make production binaries auditable via `cargo auditable`

[ryerraguntla]

Description

Type: ci / security / release
Labels: security, ci, release, A-tooling
Source: discussion #3678

Summary

Build shipped Iggy binaries (iggy-server, iggy CLI, iggy-connectors, and
release connector .so plugins where applicable) with cargo auditable so the
complete dependency tree is embedded in each artifact. Deployed binaries can then
be scanned for CVEs post-release with cargo audit bin, even when the source
tree or Cargo.lock is no longer available.

Motivation

The audit and cargo-deny gates protect the source tree at merge time. They do
not help an operator running a binary shipped months ago when a new advisory
drops. cargo auditable embeds the dependency manifest into the binary at build
time, enabling point-in-time CVE scanning of any deployed artifact. This closes
the loop: scan at merge (cargo-deny), scan at rest (cargo-auditable +
cargo audit bin).

Reference: https://github.com/rust-secure-code/cargo-auditable

Affected area / component

CI / build / tooling

Proposed solution

Proposed approach

1. Use cargo auditable build --release in the release build workflow
   (.github/workflows/_build_rust_artifacts.yml and any binary-producing
   release jobs) in place of cargo build --release for shipped artifacts.
2. CI installs cargo-auditable on demand (do not pin in
   rust-toolchain.toml; follow the on-demand cargo-tool install pattern).
3. Add a verification step: cargo audit bin <artifact> on each produced binary,
   confirming the audit data is present and scannable. Non-zero on new findings
   (or warn-only initially, aligned with the audit-remediation issue).
4. Document the operator workflow (how to run cargo audit bin against a shipped
   Iggy binary) in release docs / SECURITY guidance.
5. Confirm no meaningful binary-size or build-time regression; note the delta.

Scope / tasks

• Switch release artifact builds to cargo auditable build --release.
• Install cargo-auditable on demand in the relevant workflows.
• Add a cargo audit bin verification step over produced artifacts.
• Confirm connector .so plugin builds embed audit data (or document why not).
• Document operator-side cargo audit bin usage in release/security docs.
• Measure and record binary-size / build-time impact.

Acceptance criteria

• Shipped release binaries contain embedded audit data (cargo audit bin
  returns dependency data, not "no audit data found").
• Release workflow verifies embedded audit data per artifact.
• Operator-facing documentation describes how to scan a deployed binary.
• No unacceptable size/build-time regression (delta documented).

Related

• Audit and remediate known CVEs (sibling issue).
• Add cargo deny as a pre-merge check (sibling issue).

Alternatives considered

No response

Contribution

• I'm willing to submit a pull request to implement this feature

Good first issue

• I think this could be a good first issue for a new contributor