chore: add cargo-deny supply-chain audit gate (#53)

[OluRemiFour]

Adds a cargo-deny supply-chain audit gate to the project. Fixes #53.

Motivation

This service holds a live Stellar signing key and parses issuer-provided (untrusted) XDR, so the dependency tree is a direct attack surface:

• one unmaintained crate was previously resolved (dotenv) — swapped for dotenvy (same API, maintained fork)
• three unused crates (once_cell, base64, validator) removed
• the crate itself was unlicensed

What this adds

• deny.toml — advisories (deny yanked, flag unmaintained as informational), licenses (permissive-only allow list), bans (wildcards denied, duplicates warned), sources (filesystem/git/unknown-registries denied)
• CI workflow running cargo-deny-action on push to main and every PR

Known remaining advisories (ignored with removal path)

All require a coordinated major upgrade of the TLS stack: upgrading sqlx 0.7 -> 0.8 is blocked on reqwest 0.11 -> 0.12 (rusqlite/rustls edition). Each ignore entry in deny.toml documents the exact fix and follows RUSTSEC-2024-0363, RUSTSEC-2026-0098/0099/0104, RUSTSEC-2024-0436, RUSTSEC-2025-0134.

Verification

Local runs: advisories ok, bans ok, licenses ok, sources ok.