Add cargo-vet and cargo-deny supply-chain security

[jerrysxie]

This PR adds supply-chain security tooling based on the
embedded-rust-template:

• cargo-vet (supply-chain/) – dependency audit tracking with imports
  from ODP shared audits, Google, and Mozilla.
• cargo-deny (deny.toml) – license, advisory, ban, and source checks.
• CI workflows – cargo-vet.yml + PR comment workflow, and the
  deny job in check.yml.

After merging, run cargo vet locally to populate exemptions for any
existing unaudited dependencies:

cargo vet regenerate exemptions
cargo vet