fix(ci): add comment for cargo-deny version pin

Author: fengmk2

.github/workflows/deny.yml

@@ -44,6 +44,7 @@ jobs:
       - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
         with:
           restore-cache: false
+          # Pinned to 0.18.9+ for CVSS 4.0 support (EmbarkStudios/cargo-deny#805)
           tools: cargo-deny@0.18.9
 
       - run: cargo deny check