Fuzzing and dependency checks #17

The rest of the security gate for 2.0.

• cargo fuzz targets for ek/dk/ciphertext parsing and for decaps, each run for at least an hour of CPU time with no panics
• cargo audit and cargo deny in CI
• Pin the GitHub Actions in CI.yml by commit SHA
• Make sure no panic can reach Python (including the DummyRng in api.rs)

Done when: fuzzing finds nothing (or what it finds is fixed), and audit/deny pass in CI.

Depends on: #10. Plan: WP-8.

Part of #3.