fix(ci): resolve security audit job failure

[Copilot]

The Security Audit CI job was failing with Resource not accessible by integration because rustsec/[email protected] needs checks: write to post Check Run annotations — the job had no permissions block. Additionally, RUSTSEC-2024-0436 (paste unmaintained) was surfacing as an unhandled advisory.

Changes

• .github/workflows/ci.yml

  • Add permissions: checks: write + contents: read to security_audit job
  • Add RUSTSEC-2024-0436 to rustsec/audit-check ignore list
  • Align actions/checkout to @v4 (was @v6, inconsistent with rest of workflow)

• deny.toml

  • Add RUSTSEC-2024-0436 to [advisories] ignore with rationale comment

paste is an informational-only (unmaintained, no CVE) transitive dep via gix → curl-sys → rustls-ffi → macro_rules_attribute → paste. No patched version exists; ignoring is appropriate.

Original prompt

Please review the failing CI action (looks like security audit fail). Assess the security issue and determine what we should do about it. If you update or change dependencies please ensure all associated functionality and tests continue to run/pass as expected

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.