fix(ci): retry cargo-deny-advisories on transient network failure

advisory-db is cloned from GitHub (rustsec/advisory-db). The runner
(merkez-server) occasionally fails to reach GitHub — the clone fails
silently, the advisory-dbs/ directory is not created, and cargo-deny
then tries to run git-log on a non-existent path, producing:
  'fatal: cannot change to ...' parsed as an ISO-8601 date → crash

Real fix: GitLab native retry (max: 2, when: script_failure).
This retries the full job on infrastructure failures without bypassing
the security check — if all 3 attempts fail, the job still fails.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -210,6 +210,11 @@ cargo-deny-advisories:
   stage: security
   needs: []
   before_script: []
+  # advisory-db clone from GitHub can fail transiently (network, rate limit).
+  # Retry up to 2 times before marking the job as failed.
+  retry:
+    max: 2
+    when: script_failure
   script:
     - cargo install cargo-deny --locked -q
     - cargo deny check advisories --config deny.toml