chore: add cargo-deny configuration (#7119)

- add GitHub workflow running cargo-deny on push/PR
- document cargo-deny allowlist with workspace-dep notes and advisory
ignores
- align workspace crates to inherit version/edition/license for
consistent checks

codex-rs/codex-backend-openapi-models/Cargo.toml

@@ -1,7 +1,8 @@
 [package]
 name = "codex-backend-openapi-models"
-version = { workspace = true }
-edition = "2024"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
 
 [lib]
 name = "codex_backend_openapi_models"