Add a `cargo deny` CI step

[tomaka]

https://github.com/EmbarkStudios/cargo-deny-action

The annoying thing here is that this repo contains multiple workspaces, and cargo deny doesn't have a CLI option to check a different directory.

[tomaka]

deny.toml

[advisories]
vulnerability = "deny"
unmaintained = "warn"
yanked = "warn"
notice = "warn"

[licenses]
unlicensed = "deny"
copyleft = "allow"
allow-osi-fsf-free = "either"
default = "deny"

[bans]
multiple-versions = "warn"