fix(ci): bump cargo-deny to 0.18.6

[iamllama]

Noticed a ci failure due to some new advisory-related format being used. This was fixed upstream (https://github.com/rustsec/advisory-db/pull/2479#issuecomment-3566539814), but is a stopgap. [email protected] now supports the new format

EDIT: it has to be changed here as well 👀: https://github.com/ankitects/anki/blob/e1cd5fd0c5d11f59ca9a4cce710a4cf1f134ea9b/.buildkite/linux/entrypoint?plain=1#L26