feat(repopo): Add Rust security and audit policies

[tylerbutler]

Summary

Add policies for security best practices in Rust projects.

Proposed Policies

DenyAuditConfigured

Require deny.toml for cargo-deny security auditing:

makePolicy(DenyAuditConfigured, {
  requiredSections: ["advisories", "licenses", "bans"],
  advisories: {
    vulnerability: "deny",
    unmaintained: "warn",
  },
})

NoWildcardDependencies

Prevent overly permissive version specs:

makePolicy(NoWildcardDependencies, {
  deny: ["*"],           // Never allow wildcard
  warn: [">="],          // Warn on unbounded ranges
  allowDev: true,        // More lenient for dev-dependencies
})

NoUnsafeWithoutJustification

Scan for unsafe blocks without safety documentation:

makePolicy(NoUnsafeWithoutJustification, {
  requireComment: "// SAFETY:",
  excludePaths: ["src/ffi/"],  // Allow in FFI modules
})

This is a code-scanning policy that would need to parse Rust source files.

Use Case

Ensuring Rust projects follow security best practices for dependency management and unsafe code documentation.