[SC-38] Add cargo-audit and cargo-deny to CI

[yusuftomilola]

Overview

CI runs fmt, clippy, test, build, and a partial WASM build — but nothing checks dependencies for known vulnerabilities or license issues. For contracts governing asset ownership and multisig approvals, an advisory in a transitive dependency should fail the build.

Tasks

• Add a security job running cargo audit against contracts/Cargo.lock.
• Add cargo deny with a deny.toml covering advisories, a license allowlist, and duplicate-version detection.
• Cache the advisory database to keep the job fast.
• Add a weekly scheduled run so advisories published after a merge are still caught.
• Document how to triage and, where justified, ignore an advisory with an expiry date.

Acceptance Criteria

• Both tools run in CI and fail on a new advisory.
• deny.toml is committed and currently passing.
• The scheduled weekly run is active.

Notes for Contributors

Requires Rust + Soroban. Workspace: contracts/ (soroban-sdk 22, members: assetsup, contrib, multisig-wallet, multisig_transfer, asset-maintenance). Run cargo test --all, cargo fmt --all -- --check, and cargo clippy --all-targets --all-features -- -D warnings before opening a PR — CI enforces all three. Comment below to be assigned.

[Chinonso-Peter]

@Chinonso-Peter has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Can i work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chinonso-Peter to this issue.

[amberly-d]

@amberly-d has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

can i solve this?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @amberly-d to this issue.

[drips-wave]

Congratulations, @amberly-d! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @amberly-d: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊