Add supply chain security gates:
- cargo-deny.toml: License allowlist (MIT, Apache-2.0, BSD, ISC, Zlib,
Unicode-DFS-2016, MPL-2.0), bans (openssl-sys, native-tls, git2,
libgit2-sys), minimum versions (ring >= 0.17.5, rustls >= 0.23)
- build/CHECKSUMS.sha256: SHA-256 checksum for build/glyph-shapes.json.
build.rs already verifies checksums on every build (TH-06 supply-chain
gate per plan line 909)
These are part of the security hardening epic (pdftract-e9lz).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
