fix(ci): fix build failures and add security audit workflow

- build-linux-stable: disable forklift GCS cache (RUSTC_WRAPPER="")
  that panics without GCP credentials on VPS runners
- prepare-bridges-zombienet-artifacts: fix bridges/testing path to
  pezbridges/testing (rebrand path was not updated in workflow)
- build-rustdoc: use CARGO_TARGET_DIR instead of ./target for doc
  output path (docs generated at /cache/target/doc, not ./target/doc)
- build-push-image-*: add workspace permission fix step before checkout
  to handle root-owned files left by Docker container jobs
- All build jobs: increase timeout from 120 to 180 minutes for VPS
- Add cargo-deny + cargo-audit security audit workflow (weekly + on PR)
- Add deny.toml with license, advisory, and source checks

.github/workflows/docs.yml

@@ -85,8 +85,8 @@ jobs:
         run: |
           git config --global --add safe.directory '*'
           cargo doc --all-features --workspace --no-deps --locked --exclude pezkuwi-zombienet-sdk-tests
-      - run: rm -f ./target/doc/.lock
-      - run: mv ./target/doc ./crate-docs
+      - run: rm -f ${CARGO_TARGET_DIR}/doc/.lock
+      - run: mv ${CARGO_TARGET_DIR}/doc ./crate-docs
       - name: Inject Simple Analytics script
         run: |
           script_content="<script async defer src=\"https://apisa.pezkuwichain.io/latest.js\"></script><noscript><img src=\"https://apisa.pezkuwichain.io/latest.js\" alt=\"\" referrerpolicy=\"no-referrer-when-downgrade\" /></noscript>"