workspace: allow the permissive licenses already present in the dependency tree

[avi-starkware]

Allows the license families already present in the dependency tree: Unicode-3.0, ISC, MPL-2.0, CDLA-Permissive-2.0, BSL-1.0, bzip2-1.0.6, Apache-2.0 WITH LLVM-exception — all permissive or file-level weak copyleft. License rejections (error[rejected]) drop 41 → 1; the 7 error[unlicensed] findings below are a separate class and unchanged (8 → 7 via the bench_tools fix). bench_tools was the only workspace member not inheriting the workspace license field; it now does.

Deliberately left failing — needs a decision, not a config edit:

• rhexdump 0.2.0 is GPL-3.0-or-later, reached via aerospike = "=2.0.0-alpha.6" → starknet_patricia_storage[aerospike_storage], which starknet_committer_cli enables — i.e. it is in a shipped binary.
• 7 unlicensed: the stwo-circuits git crates declare no license. Fix is one line upstream (license = "Apache-2.0" in that repo's [workspace.package]); cargo-deny 0.20 cannot clarify them here without per-crate license files.

Because of those, the licenses step stays non-blocking (previous PR). [licenses.private] ignore is kept false with a comment: the workspace-only crates are now publish = false, and flipping it would silently drop all 99 from the license check.

🤖 Generated with Claude Code

[reviewable-StarkWare]

This change is 

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[cursor]

PR Summary

Low Risk
Config and manifest-only changes for license compliance; no runtime or security-sensitive code paths.

Overview
Expands cargo-deny [licenses].allow to cover SPDX identifiers already present in the dependency tree (e.g. ISC, MPL-2.0, Unicode-3.0, BSL-1.0, CDLA-Permissive-2.0, bzip2-1.0.6, Apache-2.0 WITH LLVM-exception), with comments noting they are permissive or file-level weak copyleft. Documents why [licenses.private] ignore stays false so publish = false workspace crates remain license-checked.

bench_tools now sets license.workspace = true, aligning it with other workspace members and addressing one unlicensed finding for that crate.

^{Reviewed by Cursor Bugbot for commit b8f0246. Bugbot is set up for automated code reviews on this repo. Configure here.}