[CONTRACT-67] Add cargo-audit and cargo-deny to CI

[mftee]

Overview

No dependency vulnerability or license-policy scanning exists for the contracts workspace. [CONTRACT-23], "Add cargo-audit and cargo-deny to CI," was closed on 2026-07-26 without landing — the CI file has no such step, confirming the pattern for a third time in this batch alongside [CONTRACT-65] and [CONTRACT-66].

Tasks

• Add a cargo-audit step to the contracts CI job checking Cargo.lock against the RustSec advisory database.
• Add cargo-deny with a baseline deny.toml covering license policy and duplicate-dependency detection.
• Document the triage process for findings.

Acceptance Criteria

• CI fails on a newly-introduced high-severity advisory or license-policy violation in the contracts workspace's dependencies.

Notes for Contributors

Requires Rust + Soroban. Workspace: contracts/ (members: identity, shipment, escrow, document, reputation). Run cargo test --all, cargo fmt --all -- --check, and cargo clippy --all-targets --all-features -- -D warnings before opening a PR — CI enforces all three. Comment below to be assigned.