Add automated Rust dependency advisory checks

[lukewilliamboswell]

Context

The Rust host is statically linked into every produced application and includes networking, TLS, terminal, randomness, and bundled SQLite dependencies. The repository pins exact dependency versions and commits Cargo.lock, but no workflow currently runs cargo audit, cargo deny, or an equivalent RustSec advisory check.

Because the resulting code is embedded into released binaries, users do not receive fixes unless basic-cli updates and rebuilds its host.

RustSec advisory database:
https://rustsec.org/advisories/

Suggested direction

Add automated dependency monitoring with:

• a pull-request advisory check;
• a scheduled workflow so newly published advisories are detected without a code change;
• Dependabot/Renovate or another deliberate update mechanism;
• a documented, time-bounded exception format for advisories that do not affect enabled features or reachable code.

Consider scanning both the main Cargo.lock and ci/rust_http_server/Cargo.lock, while clearly distinguishing release dependencies from test-only dependencies.

Acceptance criteria

• Pull requests fail on applicable unacknowledged vulnerabilities.
• A scheduled job checks for new advisories.
• Both lockfiles are covered with release/test scope clearly reported.
• Advisory exceptions require rationale, owner, and expiry/review date.
• Dependency update ownership and release rebuild expectations are documented.