ci: add cargo-deny to workflow

Integrates cargo-deny into the main CI pipeline using the official
EmbarkStudios action. This will automatically block PRs that introduce
banned licenses, insecure crates, or unallowed registries.

Author: jpoehnelt-bot

.github/workflows/ci.yml

@@ -152,6 +152,19 @@ jobs:
       - name: Clippy
         run: cargo clippy --workspace -- -D warnings
 
+  deny:
+    name: Cargo Deny
+    needs: changes
+    if: needs.changes.outputs.rust == 'true' || github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Cargo deny
+        uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
+        with:
+          command: check
+
 
   skills:
     name: Verify Skills