infra: add basic CI and security audit workflows

[crawford]

This introduces two workflows: one for basic CI (format and check) and
one for security audits. The security audit workflow probably isn't
going to catch anything, but it only runs when the cargo manifest
changes, so hopefully it doesn't slow things down too much. The CI
workflow is designed to run cargo fmt against the code and to run
cargo check with every combination of options. Right now, the
unproven feature must be enabled, which ends up requiring a nightly
compiler. As a result, the build matrix only runs two variants (one for
each of the two supported devices). Once builds can be done without the
unproven feature, ~ can be added to the proven dimension of the
matrix, which will then allow builds to run against both nightly and
stable.

Regarding the actual implementation, there are a few quirks in this
config.

The verbose on object is the result of pushes to pull requests
triggering the workflow twice - the workflow is triggerd by both the
push and pull_request events. By restricting these to the master
branch, it ensures that only pushes to the master branch or pull
requests to the master branch (but not pushes to pull request branches)
trigger.

The bizarre construction of the run step in the check job is needed
because GitHub isn't parsing the declaration correctly. The
preferred syntax would be to make use of the folded chomping block
operator and to drop the shell linewraps. Something closer to this:

steps:
  - run: >-
      cargo check
        --verbose
        --no-default-features