Add cargo deny to our presubmits (#424)

Inspired by ureq [doing the
same](algesten/ureq#661)

This will help us keep track of our dependencies and make sure we aren't
using ones with the wrong licenses.

.github/workflows/main.yml

@@ -98,6 +98,23 @@ jobs:
       - name: Rust lint
         run: cargo-fmt --all --check
 
+  cargo-deny:
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        checks:
+          - advisories
+          - bans licenses sources
+
+    # Prevent sudden announcement of a new advisory from failing ci:
+    continue-on-error: ${{ matrix.checks == 'advisories' }}
+
+    steps:
+    - uses: actions/checkout@v3
+    - uses: EmbarkStudios/cargo-deny-action@v1
+      with:
+          command: check ${{ matrix.checks }}
+
   validate-dependabot:
     runs-on: ubuntu-latest
     steps: