qa(security): add security coverage (deny/audit/gitleaks/fuzz/authz/SBOM)

[UberMetroid]

Security Coverage for rustle

This PR adds security testing infrastructure without modifying production behavior.

What is new

• .github/workflows/security.yml - CI jobs for cargo-deny, cargo-audit, gitleaks, cargo-fuzz smoke build, and CycloneDX SBOM generation.
• .github/gitleaks.toml - Secret-scanning configuration with rustle-specific allowlist (target/, dist/, tests/ui/, wordlists, Cargo.lock).
• deny.toml - cargo-deny policy for advisory DB, licenses, and sources.
• fuzz/ - cargo-fuzz harness crate excluded from the main workspace. Four self-contained targets:
  • fuzz_scorer (port of helpers/statuses.rs)
  • fuzz_encryption_roundtrip (port of helpers/encryption.rs)
  • fuzz_holiday_date_math (port of utils/holidays.rs + Easter/Thanksgiving math)
  • fuzz_pin_helper (cookie parsing + constant-time PIN comparison)
• backend/tests/authz.rs - 22 integration tests covering auth_middleware, HTML/API bypass paths, cookie attributes (HttpOnly, SameSite=Strict, Path=/, Max-Age), security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy), PIN validation (empty, length mismatch, whitespace), lockout (429 after max_attempts), rate limit via /api/verify-pin, and path-traversal probes.
• backend/src/lib.rs - minimal library shim re-exporting auth, routes, utils so the integration tests can call the real handler/middleware functions in-process via tower::ServiceExt::oneshot. No behavior change to the existing server / sh binaries.
• backend/Cargo.toml - dev-deps for tower, http-body-util, hyper, and shared-backend used by the test harness.
• Cargo.toml - excludes fuzz/ from the main workspace (cargo-fuzz requires a package manifest).

Validation run locally

cargo build --workspace                          # OK
cargo test --workspace --bins                    # 25 tests pass (7+0+18)
cargo test --workspace --tests                   # 54 tests pass total
cargo +nightly fuzz build fuzz_scorer            # builds, links, runs
cargo +nightly fuzz build fuzz_encryption_roundtrip
cargo +nightly fuzz build fuzz_holiday_date_math
cargo +nightly fuzz build fuzz_pin_helper
python3 -c 'import yaml; yaml.safe_load(...)'    # workflow yaml valid

Notes and limitations

• The fuzz crate is intentionally excluded from the main workspace and self-contained (re-implements production functions verbatim) because the production helpers depend on web-sys/gloo/Yew which require WebAssembly targets.
• No production behavior change. The only production-adjacent change is the new backend/src/lib.rs library shim needed to make auth/routes/utils importable from integration tests; the existing [[bin]] binaries continue to build and behave identically.
• Fuzz harnesses run with ASan/coverage when built via cargo +nightly fuzz build; CI builds them on Linux x86_64 only.