add audit ci workflow

[valoq]

This workflow runs cargo audit weekly and on dependency changes and opens a PR for any findings.

This may create more bot PRs though.

The alternative is to just run the audit without PRs and run cargo update manually before releases, which is more error prone

[marcospb19]

if the bot opens a PR, that catches our attention, that's important at least

so would it be reasonable for me to close it, bump that dependency myself and make a PR for it?

[marcospb19]

maybe it would be better to run cargo update dep instead of the more general cargo update 🤔

if that's the case I think I'm fine with the bot PRs : )

wdyt