Add CI step that reports `cargo audit` vulns and warnings.

[nathan-at-least]

Problem

The cargo audit tool shows vulnerabilities and warnings.

2023-06-17 Update: As dependencies and audit reports evolve, I've updated the content here for commit d2f105efe9e4a9aa3cb71010a090a5661a748a62.

Vulnerabilities

• libsqlite3-sys: RUSTSEC-2022-0090
• tokio: RUSTSEC-2023-0001

Warnings:

• stdweb: unmaintained, RUSTSEC-2020-0056
• crossbeam-channel: yanked
• h2: yanked

Proposed Solution

1. If possible resolve all vulnerabilities & warnings by dependency upgrades.
2. If not possible, analyze each report to determine attack surface for our crates. If we can prove the dependency attack surface is not exposed by any usage of our crates, we can suppress the audit report for the specific advisory tag (see Ignoring advisories, and I suggest we always add rationale doc in audit.toml as a policy.)

Preventative Solution

As soon as we get to a state of cargo audit passing, we should institute CI on cargo audit.

Reproduction

1. run cargo install cargo-audit (if not previously done)
2. run cargo audit