ci: build cargo-audit against stable rust toolchain

The daily security audit builds cargo-audit from source using the
toolchain pinned in rust-toolchain.toml. A transitive build dependency
(kstring 2.0.4) now requires Rust 1.96.0, which is newer than the pinned
channel, so the build fails and the audit never runs.

Override RUSTUP_TOOLCHAIN=stable for the audit step so cargo-audit is
built with current stable. The toolchain used to build the tool does not
affect the audit result, so this is safe.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lfrancke

.github/workflows/security_audit.yaml

@@ -21,5 +21,10 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
+        # Build against stable because cargo-audit sometimes depends on things
+        # that require a newer Rust version than our pinned toolchain. This does
+        # not influence the result, so it should be safe.
+        env:
+          RUSTUP_TOOLCHAIN: stable
         with:
           token: ${{ secrets.GITHUB_TOKEN }}