Provision Cargo for complete RustSec registry checks (#122)

.gitea/workflows/security-audit.yml

@@ -15,13 +15,13 @@ jobs:
       - name: Check out the repository
         uses: actions/checkout@v4
 
-      - name: Install the reviewed cargo-audit release
+      - name: Install Rust and the reviewed cargo-audit release
         uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af # v2
         with:
-          tool: cargo-audit@0.22.2
+          tool: rust@1.92.0,cargo-audit@0.22.2
           fallback: none
 
       - name: Reject new RustSec vulnerabilities
-        # Invoke the prebuilt binary directly: the runner has no Cargo toolchain.
+        # RustSec's registry checks require Cargo even with a prebuilt audit binary.
         # The existing RSA exception is documented in docs/ssh-transport-audit.md.
         run: cargo-audit audit --ignore RUSTSEC-2023-0071