Add cargo-vet and cargo-deny supply-chain security

[jerrysxie]

This PR adds supply-chain security tooling based on the
embedded-rust-template:

• cargo-vet (supply-chain/) – dependency audit tracking with imports
  from ODP shared audits, Google, and Mozilla.
• cargo-deny (deny.toml) – license, advisory, ban, and source checks.
• CI workflows – cargo-vet.yml + PR comment workflow, and the
  deny job in check.yml.

After merging, run cargo vet locally to populate exemptions for any
existing unaudited dependencies:

cargo vet regenerate exemptions
cargo vet

[Copilot]

Pull request overview

Adds supply-chain security tooling to the crate by introducing cargo-vet configuration/audit stubs under supply-chain/ and new GitHub Actions workflows to run cargo vet on PRs and post/update a PR comment with the result.

Changes:

• Add initial cargo-vet config/audits/import stubs in supply-chain/.
• Add cargo-vet CI workflow to run cargo vet --locked on pull requests.
• Add a workflow_run-triggered workflow to comment on PRs when cargo-vet fails (and update the comment on later success).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
supply-chain/imports.lock	Initializes cargo-vet import lock structure for external audit sources.
supply-chain/config.toml	Configures cargo-vet and defines upstream audit import URLs.
supply-chain/audits.toml	Adds a placeholder local audits file for cargo-vet.
.github/workflows/cargo-vet.yml	Introduces a PR CI job that installs and runs cargo-vet.
.github/workflows/cargo-vet-pr-comment.yml	Adds a follow-up workflow to comment/label PRs based on cargo-vet results.

Comments suppressed due to low confidence (1)

.github/workflows/cargo-vet-pr-comment.yml:75

• The failure comment links to supply-chain/README.md, but that file doesn’t exist in this repo (the supply-chain/ directory only contains audits.toml, config.toml, and imports.lock). This link will be broken for contributors; either add the referenced README or update the link to an existing doc.

            `cargo vet` has failed in this PR. Please run `cargo vet --locked` locally to check for new or updated unvetted dependencies.
            Details about the vetting process can be found in [supply-chain/README.md](../blob/main/supply-chain/README.md)