ci: ignore transitive hickory CVEs blocked by iroh's hard-pin

RUSTSEC-2026-0119 (hickory-proto O(n²) name-compression DoS) and
RUSTSEC-2026-0120 (hickory-net NSEC3 unbounded loop / OOM) both fire
against hickory 0.26.0-beta.4. Fixed upstream in hickory 0.26.1, but
iroh 0.98.2 hard-pins hickory-resolver = "=0.26.0-beta.4" so we
can't bump transitively. Unblock once iroh releases a version that
relaxes the pin.

.github/workflows/ci.yml

@@ -62,7 +62,9 @@ jobs:
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-audit
-      - run: cargo audit
+      # cargo-audit doesn't read deny.toml, so mirror its ignore list here.
+      # See deny.toml [advisories] for rationale on each ID.
+      - run: cargo audit --ignore RUSTSEC-2026-0119 --ignore RUSTSEC-2026-0120
 
   # ── Public-API semver compliance (PR only) ────────────────────────
   semver: