chore: add cargo-deny, fuzz targets compile, spatial+provenance benchmarks

Extends the CI suite to the remaining static-analysis gates and rounds
out benchmark coverage to all 8 modalities.

cargo-deny:
- Added [advisories] ignore list for the 5 transitive-only advisories in
  the burn ML stack (bincode/core2/paste/rustls-pemfile/lru). Each entry
  is documented with the upstream chain so we can prune them after a
  burn upgrade clears the corresponding crate.
- Set [bans] allow-wildcard-paths = true so workspace path deps don't
  trip the wildcard guard.
- Added "CDLA-Permissive-2.0" to license allow-list (webpki-root-certs).
- Dropped unused "Unicode-DFS-2016" and "OpenSSL" entries.
- Added publish = false to all 17 rust-core crates so cargo-deny knows
  the wildcard-path exemption applies (publishable crates can't have
  path deps).
- Added MPL-2.0 license + publish = false to verisimdb-benchmarks
  (cargo-deny was flagging it as unlicensed).

Benchmarks:
- New bench_spatial_operations: index_point, search_radius_5km,
  nearest_10 against a 1000-point pre-populated store. First run
  produced ~1.4 µs index, ~46 µs radius search, ~195 µs k=10 nearest.
- New bench_provenance_operations: record_event_append, verify_chain_1000
  (full SHA-256 hash-chain verification of 1000 records), search_by_actor.
  ~3.3 µs append, ~2.8 ms chain verify, ~32 µs actor search.
- All 8 modalities now have dedicated benchmark coverage.

Fuzz targets (both crates):
- fuzz/Cargo.toml was missing the uuid dep its target uses
- rust-core/fuzz/ was missing a [workspace] table, so cargo-check from
  the parent workspace failed to locate it
- fuzz_vql_parser.rs referenced verisim_api::vql::parse() which doesn't
  exist; switched to ::tokenize() (made public, was private)
- .gitignore now covers fuzz/target/ and rust-core/fuzz/target/

GitHub Actions additions to rust-ci.yml:
- deny: cargo deny check advisories bans licenses sources
- fuzz-compile: matrix over both fuzz manifests, cargo check each

https://claude.ai/code/session_01GeiWCLLoZmPdnjMMcy2buu

Author: claude

.github/workflows/rust-ci.yml

@@ -75,7 +75,7 @@ jobs:
     name: cargo deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check advisories bans licenses sources
@@ -98,8 +98,7 @@ jobs:
           - fuzz/Cargo.toml
           - rust-core/fuzz/Cargo.toml
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo check --manifest-path ${{ matrix.manifest }}
-