[Feature]: Run cargo audit on a schedule instead of a hard gate on every PR

[rogkne]

Feature Description

Move the security advisory check off the critical path of every pull request so a new
advisory does not block unrelated work.

Use Case

The pull request workflow installs cargo-audit and runs cargo audit as a required
check. Advisories are published continuously, so a pull request that never touched the
dependencies can start failing the day a new advisory lands. That makes the check time
dependent and blocks contributors for reasons outside their change.

Proposed Solution

Run the audit in a scheduled job, for example daily, with a dedicated workflow or the
rustsec/audit-check action, and keep the existing suppression flow in
.cargo/audit.toml and vulnlog.yml. A lighter audit can still run on pull requests,
but the deterministic checks should be the ones that gate a merge.

Additional Context

• .github/workflows/pull-request.yml check matrix runs cargo install cargo-audit
  then cargo audit
• .cargo/audit.toml and vulnlog.yml already track accepted advisories