[CI] Add cargo audit dependency vulnerability scan job to ci.yml

[davidmaronio]

Context

ci.yml has fmt, clippy, and test jobs but no dependency vulnerability scanning. Adding a cargo audit (or cargo deny) job would catch known-vulnerable crates in Cargo.lock, including in the vendored dependency tree.

Acceptance criteria

• Behavior/gap described above is addressed or confirmed and documented
• Relevant unit test(s) added or updated
• cargo fmt --check and cargo clippy --all-targets --features testutils -- -D warnings pass

Files to touch

.github/workflows/ci.yml, Cargo.lock

Out of scope

• Unrelated refactors outside the files listed above
• Changes to unrelated contract functions not mentioned in this issue