fix: add missing Rust CI parity checks

[lucarlig]

Summary

• add plugin-scoped CI jobs for security audit, benchmark build verification, coverage, and documentation
• add workflow_dispatch to the main CI workflow and keep the existing changed-plugin selection logic
• consolidate cargo-deny onto a single workspace-level deny.toml and remove per-plugin copies
• add regression tests covering the parity jobs and the single deny-config contract