fix: re-run cargo-deny on a schedule to catch new advisories

[MaximeGaudin]

Summary

• cargo deny check only ran on pushes/PRs, so a new RustSec advisory published against an already-merged dependency was never re-detected until the next unrelated change touched CI.
• Added a dedicated audit.yml workflow that runs the same cargo deny check (fresh runner, so the advisory DB is always re-fetched — cargo-deny clones/updates the DB on every non-offline run) daily at 06:00 UTC, plus a workflow_dispatch for manual runs.
• The new workflow follows the repo's hardening conventions: explicit permissions: contents: read, a timeout-minutes, a concurrency group, and actions pinned to full commit SHAs.

Verified locally: cargo deny check passes on the current tree (advisories, bans, licenses, sources all ok).

Fixes #189

Test plan

• Workflow file parses as valid YAML; cargo deny check run locally with the same command the job uses.
• CI green on the PR