fix: reject unknown git sources in cargo-deny

[MaximeGaudin]

Summary

• [sources] had unknown-git = "allow", so a dependency pulled from an arbitrary git URL would pass the source check as long as it wasn't in allow-git (which is empty).
• Set unknown-git = "deny". A git dependency now fails cargo deny check unless it is explicitly added to allow-git with a reason.

Fixes #216

Test plan

• The current dependency graph has no git sources (source = "git" is absent from Cargo.lock), so cargo deny check sources passes with the stricter setting.
• CI green on the PR