chore: add cargo-deny configuration (#7119)

- add GitHub workflow running cargo-deny on push/PR
- document cargo-deny allowlist with workspace-dep notes and advisory
ignores
- align workspace crates to inherit version/edition/license for
consistent checks

codex-rs/windows-sandbox-rs/Cargo.toml

@@ -1,7 +1,8 @@
 [package]
-name = "codex-windows-sandbox"
-version = "0.1.0"
 edition = "2021"
+license.workspace = true
+name = "codex-windows-sandbox"
+version.workspace = true
 
 [lib]
 name = "codex_windows_sandbox"
@@ -9,20 +10,19 @@ path = "src/lib.rs"
 
 [dependencies]
 anyhow = "1.0"
+dunce = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
-dunce = "1.0"
 [dependencies.codex-protocol]
 package = "codex-protocol"
 path = "../protocol"
 [dependencies.rand]
-version = "0.8"
 default-features = false
 features = ["std", "small_rng"]
+version = "0.8"
 [dependencies.dirs-next]
 version = "2.0"
 [dependencies.windows-sys]
-version = "0.52"
 features = [
     "Win32_Foundation",
     "Win32_System_Diagnostics_Debug",
@@ -45,3 +45,4 @@ features = [
     "Win32_System_Com",
     "Win32_Security_Authentication_Identity",
 ]
+version = "0.52"