ci: appease rustfmt; ignore RUSTSEC-2023-0071 with justification

Two fixes for the failed checks on the merge commit:

- cargo fmt --check flagged a line wrap in the new import --qr error
  path; reformatted.
- cargo audit fails on RUSTSEC-2023-0071 (Marvin timing attack in the
  rsa crate, no fixed release). keyroost-rsakey uses the crate only for
  host-side key generation and PKCS#1/PKCS#8 serialization during
  OpenPGP import — it never decrypts attacker-supplied ciphertexts, so
  the vulnerable path is unreachable. Ignored in .cargo/audit.toml with
  the reasoning recorded; the audit workflow now also re-runs when that
  config changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: framefilter

.cargo/audit.toml

@@ -0,0 +1,12 @@
+# cargo-audit configuration — advisory ignores need a written justification.
+
+[advisories]
+ignore = [
+    # Marvin Attack: timing side-channel in RSA PKCS#1 v1.5 *decryption*
+    # (`rsa` crate, no fixed release). keyroost-rsakey uses the crate only
+    # for host-side key generation and PKCS#1/PKCS#8 serialization during
+    # OpenPGP import — it never decrypts attacker-supplied ciphertexts, so
+    # the vulnerable code path is unreachable. Revisit when a fixed `rsa`
+    # version ships.
+    "RUSTSEC-2023-0071",
+]

.github/workflows/audit.yml

@@ -6,9 +6,9 @@ name: Security audit
 on:
   push:
     branches: [main]
-    paths: ['Cargo.lock', 'Cargo.toml', 'crates/**/Cargo.toml']
+    paths: ['Cargo.lock', 'Cargo.toml', 'crates/**/Cargo.toml', '.cargo/audit.toml']
   pull_request:
-    paths: ['Cargo.lock', 'Cargo.toml', 'crates/**/Cargo.toml']
+    paths: ['Cargo.lock', 'Cargo.toml', 'crates/**/Cargo.toml', '.cargo/audit.toml']
   schedule:
     - cron: '17 6 * * 1' # Mondays 06:17 UTC
   workflow_dispatch:

crates/keyroostctl/src/main.rs

@@ -1363,8 +1363,7 @@ fn run() -> Result<(), Box<dyn std::error::Error>> {
                 match import.entries.len() {
                     0 => {
                         return Err(
-                            "QR decoded, but no account could be imported (see skips above)"
-                                .into(),
+                            "QR decoded, but no account could be imported (see skips above)".into(),
                         )
                     }
                     1 => import.entries.into_iter().next().unwrap(),