Add `cargo audit` flake check

[srid]

Such that nix flake check will automatically run cargo audit and fail on serious vulnerabilities.

This can be implemented rather easily using crane's function:

https://crane.dev/API.html?highlight=cargoAudit#cranelibcargoaudit

[srid]

Since advisory db is normally downloaded, this would make it an impure dependency. We could pin it (see above), but then we should come up with a (documented or automated) mechanism to update that flake input periodically.