fix(security): add NCSA and CDLA-Permissive-2.0 licenses, disable fail-fast

- Add NCSA and CDLA-Permissive-2.0 to allowed licenses in deny.toml
  (both are permissive open-source licenses used by transitive deps)
- Set fail-fast: false on cargo-deny matrix so all checks run
  independently even if one fails

deny.toml

@@ -64,6 +64,8 @@ allow = [
 	"Unicode-DFS-2016",
 	"Unlicense",
 	"Zlib",
+	"NCSA",
+	"CDLA-Permissive-2.0",
 ]
 exceptions = [
 	# ring uses a custom ISC-style license