Dependency checker for Rust code

[patchwork01]

Background

Split from:

• #1359

Depends on:

• #2864

Description

We'd like to add dependency checking for the new Rust code.

Analysis

The OWASP dependency checker does not support Rust at time of writing:

https://jeremylong.github.io/DependencyCheck/analyzers/index.html

The OWASP dep-scan project does support Rust. It produced a large number of false positives when tested, insisting that the Rust http crate was an older version of the Java Apache HttpClient. See earlier commits in this PR.

We can use cargo audit instead:

https://github.com/rustsec/rustsec/tree/main/cargo-audit