fix: time-box the RUSTSEC-2026-0222 ignore with a CI-enforced deadline

[MaximeGaudin]

Summary

• RUSTSEC-2026-0222 (wasmtime, GHSA-hgjw-h833-99q9) was ignored in deny.toml with no expiry. Advisory state verified against the current RustSec DB: it is patched only in >= 46.0.2 and >= 47.0.3 — no 43.x release fixes it — and the lock carries wasmtime 43.0.2 via extism 1.30, which pins wasmtime = "43". extism 1.30.0 is the newest extism release, so a bump is not possible; the ignore had to stay.
• cargo-deny (0.20.2, what the CI action installs) has no until/expiry field for advisory ignores, so the time-box is enforced in CI: new scripts/check-ignore-deadlines.mjs requires every advisory ignore entry to carry an # expires: YYYY-MM-DD in its comment block and fails when the date passes. It runs in the deny job.
• The entry now carries the justification and # expires: 2026-10-31; after that date every PR fails until the advisory is re-evaluated (extism moves to a patched wasmtime, or we patch it).

Fixes #195

Test plan

• Checker failed on the original untime-boxed entry (red), passes on the updated deny.toml (green); expired-date and missing-date fixtures both fail as intended.
• cargo deny check still passes locally (advisories, bans, licenses, sources ok).
• CI green on the PR