scripts,workspace: bump cargo-deny to 0.20.2 so the check runs

[avi-starkware]

The CI cargo-deny job has never evaluated a check: cargo-deny 0.16.2 (pinned in scripts/install_cargo_tools.sh) rejects the allow-workspace key in deny.toml and exits while deserializing the config, and continue-on-error: true hides the exit code. Even with that key removed, 0.16.2 aborts on advisories carrying CVSS 4.0 scores.

• Pin cargo-deny 0.20.2 (latest; needs Rust ≥1.88, toolchain is 1.96). It accepts the allow-workspace key, so the template deny.toml stays as is apart from the addition below.
• allow-wildcard-paths = true under [bans]. It only exempts dev-dependency path deps and publish = false crates, which is why workspace,scripts: mark workspace-only crates publish = false and enforce it when publishing #15115 below marks the workspace-only crates publish = false first. With both, bans reports exactly one wildcard: starknet_proof_verifier is publishable but depends on the git dependency privacy-circuit-verify-v2 with no crates.io version — a real finding, deliberately left visible.

Verified: cargo deny check parses and runs all four checks (advisories FAILED, bans FAILED, licenses FAILED, sources ok at this point; bans is down to the single finding above, and the following PRs address advisories and licenses); taplo fmt --check clean.

🤖 Generated with Claude Code

[reviewable-StarkWare]

This change is 

[github-actions]

Artifacts upload workflows:

• Started at 2026-09-14T09:51:24Z

[cursor]

PR Summary

Low Risk
Tooling and deny.toml configuration only; no application runtime behavior changes, though CI may now report real advisories/licenses/bans findings that were previously skipped.

Overview
Fixes CI cargo deny check, which previously failed during config parse on the pinned 0.16.2 tool (and could be masked by continue-on-error). The install script now pins cargo-deny 0.20.2, which supports the existing deny.toml shape and current advisory metadata.

Under [bans], allow-wildcard-paths = true is added so workspace path dependencies without version requirements are not flagged as wildcard violations when they are dev-dependencies or publish = false crates; publishable crates with unversioned path/git deps still surface in the bans check.

^{Reviewed by Cursor Bugbot for commit e3b3021. Bugbot is set up for automated code reviews on this repo. Configure here.}