Check for duplicate crate dependencies in CI

[teor2345]

Motivation

When we add duplicate dependencies, Zebra compiles slower, and its binaries will be larger.
This slows down CI, and can fill up CI disks.

In some cases, duplicate dependencies can result in hard-to-diagnose bugs in Zebra.
This happens because code expects a single instance of some structs, but there are multiple instances running.

Duplicate dependencies and unexpected crate sources can also be a security risk.

Scheduling

This is unexpected work in Sprint 21, to make sure that tokio is upgraded correctly.

It should be merged before the tokio roll-up PR.

Solution

This PR detects new duplicate dependencies and new unexpected crate sources.
Current duplicates and sources are allowed. I opened separate tickets to remove them.

CI:

• Add a cargo deny check bans step to CI
• Add a cargo deny check sources step to CI
• Make sure Cargo.lock is up to date in CI, because it is used by these checks

Configuration:

• Allow the current set of duplicates and sources in the deny.toml config
  (so this PR doesn't actually need to change any dependencies)

Review

@jvff should review this PR.

It blocks the tokio roll-up PR.

Reviewer Checklist

• CI passes
• deny.toml makes sense
• new GitHub actions make sense

Follow Up Work

• PR Check that Zebra is only using one version of tokio #2987 as part of ticket Upgrade to latest tokio #2200

Tickets:

• Upgrade librustzcash-related crypto dependencies #2952
• Upgrade tracing to the next major version #2953
• Reduce the dependencies on different versions of rand #2391
• Remove outdated arrayvec dependency used by inferno #2980
• Use the latest bindgen version in zcash_script and rocksdb #2981
• Upgrade to NU5 testnet 2 versions of librustzcash, zcash_script, orchard, halo2_proofs #2982
• Upgrade to criterion 0.3.5 or later #2983
• Remove duplicate owo-colors dependency #2984
• Replace outdated tempdir dependency with tempfile #2985