feat: complete workflow optimization and security hardening

[joshrotenberg]

Summary

Completes all remaining items from issue #19 for workflow optimization and security hardening.

Security Improvements ✅

• cargo-deny workflow: License and dependency policy enforcement
• CodeQL analysis: Static security analysis for Rust code
• Pinned actions: All GitHub Actions pinned to commit SHAs
• Concurrency groups: Prevent duplicate workflow runs
• Comprehensive deny.toml: Configure allowed/denied licenses

Performance Improvements ✅

• Added concurrency groups to all workflows to cancel duplicate runs
• Caching already optimal with Swatinem/rust-cache@v2

Documentation Updates ✅

• Added prominent section about Rust client libraries in README
• Emphasized that we provide full-featured client libraries not just a CLI
• Added detailed library usage examples

Testing

All workflows tested and validated:

• ✅ cargo-deny configured with sensible defaults
• ✅ CodeQL configured for Rust analysis
• ✅ All actions use pinned versions for security
• ✅ Concurrency groups prevent wasted CI resources

Checklist from Issue #19

Security Auditing 🔒

• cargo-audit for dependency vulnerability scanning (PR feat: add security audit workflow and fix crates.io README display #20)
• cargo-deny for license and security checks
• SARIF output for GitHub Security tab (PR feat: add security audit workflow and fix crates.io README display #20)
• Pin action versions to commit SHAs
• Dependency review action for PRs (PR feat: add security audit workflow and fix crates.io README display #20)
• CodeQL analysis for Rust

Dependency Caching

• Rust toolchain caching verified working
• Cargo registry caching with Swatinem/rust-cache
• Cache hit rates optimized

Job Parallelization

• Concurrency groups added to prevent duplicate runs
• Matrix strategy already optimal

Closes #19

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.