[bgentry]

Separate Rust security advisory scanning from the other quality checks. Today, cargo deny checks advisories together with dependency licenses, bans, and sources, so a newly disclosed vulnerability can turn the quality job red even when a PR changes no dependencies.

Rust quality keeps linting, documentation and examples, and dependency license, ban, and source checks. A separate Rust advisories job checks the security advisory database. Both jobs report their own results in the existing Rust workflow, keeping advisory failures visible without obscuring the quality checks we may want to require.

Keep the existing workflow path filters so Rust checks continue to run only when Rust code or its shared inputs change.

[bgentry]

@brandur it seemed funky to me that Rust security advisories were bundled into the same CI check as things that should probably be blocking, like lint issues. This is my attempt to split them apart. Nothing is enforced as of now though—the way we have jobs/workflows only conditionally running on certain paths isn't really compatible with this, and we might want to rethink how that's done to be compatible with required checks.