[Security Fix] ci: extend CodeQL analysis and cargo audit to Rust smart contracts

[gospeltout]

Description

Adds Rust static analysis (CodeQL) and dependency vulnerability auditing (cargo audit) for the Soroban smart-contract code in .github/workflows/security.yml. Previously, CodeQL only analyzed JavaScript and TypeScript, leaving the smart contract (the repository's primary attack surface) without CodeQL analysis.

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• 🔧 Refactoring (no functional changes)
• ⚡ Performance improvement
• 🧪 Test addition or update

Related Issues

Resolves CodeQL missing Rust smart-contract analysis audit finding.

Changes Made

• Updated .github/workflows/security.yml CodeQL matrix to language: [ 'javascript', 'typescript', 'rust' ].
• Added conditional Rust toolchain setup (dtolnay/rust-toolchain@stable) and build step (cargo check --workspace --all-targets) in contracts/ for CodeQL indexing.
• Added cargo audit step to the dependency-check job in security.yml to audit contracts/Cargo.lock.
• Updated pull_request triggers in security.yml to include develop branch.

Testing

Test Coverage

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed

Test Steps

1. Run npm run verify-security to verify security workflow and policy checks.
2. Run cargo clippy --all-targets -- -D warnings in contracts/ to confirm clean static analysis.
3. Run cargo test in contracts/ to verify all contract unit and property tests pass.

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published
• I have checked for breaking changes and documented them if applicable

Additional Notes

Ran npm run verify-security locally (6/6 passed) and verified cargo clippy and cargo test pass cleanly.

Closes #1279

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.