ci: run cargo deny to check licenses/vulnerabilities

.github/workflows/build.yml

@@ -124,4 +124,4 @@ jobs:
           toolchain: "1.85"
 
       - name: Check MSRV
-        run: cargo check --locked --all-features
+        run: cargo check --locked --all-features -p upki -p rustls-upki -p upki-openssl -p upki-cli

.github/workflows/lints.yml

@@ -61,5 +61,11 @@ jobs:
 
       - name: clang-format
         run: |
-            clang-format -i upki/ffi-example/upki-demo.c
-            git diff --exit-code
+          clang-format -i upki/ffi-example/upki-demo.c
+          git diff --exit-code
+
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: EmbarkStudios/cargo-deny-action@v2

deny.toml

@@ -0,0 +1,17 @@
+[licenses]
+version = 2
+allow = [
+  "Apache-2.0",
+  "BSD-3-Clause",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MPL-2.0",
+  "Unicode-3.0",
+]
+private = { ignore = true }
+
+[advisories]
+ignore = [
+  "RUSTSEC-2025-0141", # bincode is unmaintained; going away with newer CRLite versions
+]

revoke-test/Cargo.toml

@@ -4,6 +4,7 @@ version = "0.1.0"
 rust-version.workspace = true
 edition.workspace = true
 repository.workspace = true
+publish = false
 
 [dependencies]
 aws-lc-rs.workspace = true