build: lock and verify release dependencies

[XiaoHongbo-Hope]

Summary

• Commit Cargo.lock and use locked dependency resolution in CI and binding builds.
• Declare publish and MSRV metadata for every workspace package.
• Generate and verify target-specific Rust dependency reports.
• Migrate OpenDAL to its 0.58 split crates, removing the vulnerable quick-xml 0.39 dependency.
• Enforce advisory and license checks with pinned release tooling.

Security

• RUSTSEC-2026-0194 and RUSTSEC-2026-0195 are resolved.
• RSA and two PyO3 advisories are documented exceptions because the affected APIs are not used.
• instant and paste remain warnings because no safe upgrade is available.

Scope

This is the shared foundation split from #554. Binding legal files and publishing workflow changes remain in their dedicated PRs.

Verification

• cargo deny --locked --all-features check --warn unmaintained advisories licenses
• python3.11 scripts/dependencies.py generate
• python3.11 scripts/dependencies.py verify
• cargo check --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test -p paimon io::storage
• cargo package --locked -p paimon -p paimon-datafusion --all-features
• actionlint and git diff --check

[QuakeWang]

LGTM