ci: fix Rust dependency audit reporting

[forhappy]

Summary

• Grant the dependency-audit job checks: write so rustsec/audit-check can publish its Security audit Check.
• Pin the action to RustSec's Node 24 update, removing the Node 20 deprecation warning.

Context

The failed CI run found no vulnerabilities, but the action failed while creating a Check Run because the token only had contents: read. The two unmaintained advisories are reported as warnings and do not indicate a vulnerability failure.

Verification

• Workflow YAML parsed successfully.
• git diff --check passed.
• No Rust tests run; this is a workflow-only change.